linux/mm/folio-compat.c
Jann Horn 1dea8e081e mm/page-writeback: document folio_mark_dirty() locking more explicitly
We have had bugs where set_page_dirty() was used on a page from GUP
without appropriate locking, leading to UAF, in:

 - KVM, see
   https://lore.kernel.org/r/20260810-x86-kvm-setpagedirty-v1-1-85f180892d4f@google.com
 - i915, see commit 0d4bbe3d40 ("drm/i915/userptr: Try to acquire the
   page lock around set_page_dirty()").
 - VMCI, see commit 5a16c53540 ("VMCI: Use set_page_dirty_lock() when
   unregistering guest memory")
 - kpc2000 staging driver, see commit b6d13bd9f2 ("staging: kpc2000:
   kpc_dma: Convert set_page_dirty() --> set_page_dirty_lock()")

I think set_page_dirty() and folio_mark_dirty() need more explicit
documentation on how they should be used with pages from GUP; so add a
comment on top of set_page_dirty() and make the comment above
folio_mark_dirty() more explicit.

Link: https://lore.kernel.org/20260810-set-page-dirty-warnings-v2-1-1bd40fadfacd@google.com
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:43:19 -07:00

89 lines
2.1 KiB
C

// SPDX-License-Identifier: GPL-2.0
/*
* Compatibility functions which bloat the callers too much to make inline.
* All of the callers of these functions should be converted to use folios
* eventually.
*/
#include <linux/migrate.h>
#include <linux/pagemap.h>
#include <linux/rmap.h>
#include <linux/swap.h>
#include "internal.h"
void unlock_page(struct page *page)
{
return folio_unlock(page_folio(page));
}
EXPORT_SYMBOL(unlock_page);
void end_page_writeback(struct page *page)
{
return folio_end_writeback(page_folio(page));
}
EXPORT_SYMBOL(end_page_writeback);
void wait_on_page_writeback(struct page *page)
{
return folio_wait_writeback(page_folio(page));
}
EXPORT_SYMBOL_GPL(wait_on_page_writeback);
void mark_page_accessed(struct page *page)
{
folio_mark_accessed(page_folio(page));
}
EXPORT_SYMBOL(mark_page_accessed);
void set_page_writeback(struct page *page)
{
folio_start_writeback(page_folio(page));
}
EXPORT_SYMBOL(set_page_writeback);
/* Read the comment above folio_mark_dirty() regarding required locks! */
bool set_page_dirty(struct page *page)
{
return folio_mark_dirty(page_folio(page));
}
EXPORT_SYMBOL(set_page_dirty);
int set_page_dirty_lock(struct page *page)
{
return folio_mark_dirty_lock(page_folio(page));
}
EXPORT_SYMBOL(set_page_dirty_lock);
bool clear_page_dirty_for_io(struct page *page)
{
return folio_clear_dirty_for_io(page_folio(page));
}
EXPORT_SYMBOL(clear_page_dirty_for_io);
bool redirty_page_for_writepage(struct writeback_control *wbc,
struct page *page)
{
return folio_redirty_for_writepage(wbc, page_folio(page));
}
EXPORT_SYMBOL(redirty_page_for_writepage);
int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
pgoff_t index, gfp_t gfp)
{
return filemap_add_folio(mapping, page_folio(page), index, gfp);
}
EXPORT_SYMBOL(add_to_page_cache_lru);
noinline
struct page *pagecache_get_page(struct address_space *mapping, pgoff_t index,
fgf_t fgp_flags, gfp_t gfp)
{
struct folio *folio;
folio = __filemap_get_folio(mapping, index, fgp_flags, gfp);
if (IS_ERR(folio))
return NULL;
return folio_file_page(folio, index);
}
EXPORT_SYMBOL(pagecache_get_page);