github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-12 12:34:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mm/page-writeback: document folio_mark_dirty() locking more explicitly

Browse Source 
We have had bugs where set_page_dirty() was used on a page from GUP
without appropriate locking, leading to UAF, in:

 - KVM, see
   https://lore.kernel.org/r/20260810-x86-kvm-setpagedirty-v1-1-85f180892d4f@google.com
 - i915, see commit 0d4bbe3d40 ("drm/i915/userptr: Try to acquire the
   page lock around set_page_dirty()").
 - VMCI, see commit 5a16c53540 ("VMCI: Use set_page_dirty_lock() when
   unregistering guest memory")
 - kpc2000 staging driver, see commit b6d13bd9f2 ("staging: kpc2000:
   kpc_dma: Convert set_page_dirty() --> set_page_dirty_lock()")

I think set_page_dirty() and folio_mark_dirty() need more explicit
documentation on how they should be used with pages from GUP; so add a
comment on top of set_page_dirty() and make the comment above
folio_mark_dirty() more explicit.

Link: https://lore.kernel.org/20260810-set-page-dirty-warnings-v2-1-1bd40fadfacd@google.com
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Jann Horn 2026-08-10 20:10:01 +02:00 committed by Andrew Morton
parent a8b5875741
commit 1dea8e081e
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
mm/folio-compat.c
View File

@ -41,6 +41,7 @@ void set_page_writeback(struct page *page)
}
EXPORT_SYMBOL(set_page_writeback);
/* Read the comment above folio_mark_dirty() regarding required locks! */
bool set_page_dirty(struct page *page)
{
return folio_mark_dirty(page_folio(page));

5
mm/page-writeback.c
View File

@ -2763,6 +2763,11 @@ EXPORT_SYMBOL(folio_redirty_for_writepage);
* in this folio. Truncation will block on the page table lock as it
* unmaps pages before removing the folio from its mapping.
*
* .. DANGER::
* Do not use this on a folio obtained from a function like
* get_user_pages_fast() without holding appropriate locks; you might want to
* use set_page_dirty_lock() or folio_mark_dirty_lock() instead.
*
* Return: True if the folio was newly dirtied, false if it was already dirty.
*/
bool folio_mark_dirty(struct folio *folio)