Nadav Amit 7af52b620d hugetlbfs: flush TLBs correctly after huge_pmd_unshare ... ANBZ: #636 commit a4a118f2ee upstream. When __unmap_hugepage_range() calls to huge_pmd_unshare() succeed, a TLB flush is missing. This TLB flush must be performed before releasing the i_mmap_rwsem, in order to prevent an unshared PMDs page from being released and reused before the TLB flush took place. Arguably, a comprehensive solution would use mmu_gather interface to batch the TLB flushes and the PMDs page release, however it is not an easy solution: (1) try_to_unmap_one() and try_to_migrate_one() also call huge_pmd_unshare() and they cannot use the mmu_gather interface; and (2) deferring the release of the page reference for the PMDs page until after i_mmap_rwsem is dropeed can confuse huge_pmd_unshare() into thinking PMDs are shared when they are not. Fix __unmap_hugepage_range() by adding the missing TLB flush, and forcing a flush when unshare is successful. Fixes: 24669e5847 ("hugetlb: use mmu_gather instead of a temporary linked list for accumulating pages)" # 3.6 Signed-off-by: Nadav Amit <namit@vmware.com> Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Fixes: CVE-2021-4002 Signed-off-by: Shile Zhang <shile.zhang@linux.alibaba.com> Reviewed-by: Gang Deng <gavin.dg@linux.alibaba.com> Reviewed-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>		2022-03-14 02:45:15 +00:00
..
boards	Fix allyesconfig output.	2019-08-04 09:30:57 +02:00
boot	.gitignore: add SPDX License Identifier	2020-09-02 17:52:15 +08:00
cchips	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
configs	firmware: Drop FIRMWARE_IN_KERNEL Kconfig option	2018-01-25 12:46:30 +01:00
drivers	PCI: Call dma_debug_add_bus() for pci_bus_type from PCI core	2018-07-30 15:58:01 -05:00
include	hugetlbfs: flush TLBs correctly after huge_pmd_unshare	2022-03-14 02:45:15 +00:00
kernel	.gitignore: add SPDX License Identifier	2020-09-02 17:52:15 +08:00
lib	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
lib64	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
math-emu	signal/sh: Use force_sig_fault where appropriate	2018-04-25 10:44:09 -05:00
mm	mm: convert return type of handle_mm_fault() caller to vm_fault_t	2018-08-17 16:20:28 -07:00
oprofile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
tools	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Kconfig	Consolidation of Kconfig files by Christoph Hellwig.	2018-08-15 13:05:12 -07:00
Kconfig.cpu	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Kconfig.debug	Kconfig: consolidate the "Kernel hacking" menu	2018-08-02 08:06:48 +09:00
Makefile	kbuild: rename LDFLAGS to KBUILD_LDFLAGS	2018-08-24 08:22:08 +09:00