Messages in this thread Patch in this message | | | Date | Thu, 15 Jun 2023 16:10:00 -0700 (PDT) | From | Hugh Dickins <> | Subject | [PATCH v2 28/32 fix] mm/memory: allow pte_offset_map[_lock]() to fail: fix |
| |
__wp_page_copy_user() was liable to call update_mmu_tlb() with NULL vmf->pte in two places: not a problem today, but could become a problem later when pte_offset_map_lock() fails.
Signed-off-by: Hugh Dickins <hughd@google.com> --- Andrew, please add this as a fix patch for later merge into my "mm/memory: allow" patch in mm-unstable: it's something noticed while researching the bug Nathan reported, but not so serious - thanks.
mm/memory.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/memory.c b/mm/memory.c index 4ec46eecefd3..cdadcff5ab26 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -2843,7 +2843,8 @@ static inline int __wp_page_copy_user(struct page *dst, struct page *src, * Other thread has already handled the fault * and update local tlb only */ - update_mmu_tlb(vma, addr, vmf->pte); + if (vmf->pte) + update_mmu_tlb(vma, addr, vmf->pte); ret = -EAGAIN; goto pte_unlock; } @@ -2867,7 +2868,8 @@ static inline int __wp_page_copy_user(struct page *dst, struct page *src, vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl); if (unlikely(!vmf->pte || !pte_same(*vmf->pte, vmf->orig_pte))) { /* The PTE changed under us, update local tlb */ - update_mmu_tlb(vma, addr, vmf->pte); + if (vmf->pte) + update_mmu_tlb(vma, addr, vmf->pte); ret = -EAGAIN; goto pte_unlock; } -- 2.35.3
| |