mirror of
https://github.com/torvalds/linux.git
synced 2026-09-11 20:13:02 +02:00
We have had bugs where set_page_dirty() was used on a page from GUP without appropriate locking, leading to UAF, in: - KVM, see https://lore.kernel.org/r/20260810-x86-kvm-setpagedirty-v1-1-85f180892d4f@google.com - i915, see commit0d4bbe3d40("drm/i915/userptr: Try to acquire the page lock around set_page_dirty()"). - VMCI, see commit5a16c53540("VMCI: Use set_page_dirty_lock() when unregistering guest memory") - kpc2000 staging driver, see commitb6d13bd9f2("staging: kpc2000: kpc_dma: Convert set_page_dirty() --> set_page_dirty_lock()") I think set_page_dirty() and folio_mark_dirty() need more explicit documentation on how they should be used with pages from GUP; so add a comment on top of set_page_dirty() and make the comment above folio_mark_dirty() more explicit. Link: https://lore.kernel.org/20260810-set-page-dirty-warnings-v2-1-1bd40fadfacd@google.com Signed-off-by: Jann Horn <jannh@google.com> Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Christoph Hellwig <hch@lst.de> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
89 lines
2.1 KiB
C
89 lines
2.1 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Compatibility functions which bloat the callers too much to make inline.
|
|
* All of the callers of these functions should be converted to use folios
|
|
* eventually.
|
|
*/
|
|
|
|
#include <linux/migrate.h>
|
|
#include <linux/pagemap.h>
|
|
#include <linux/rmap.h>
|
|
#include <linux/swap.h>
|
|
#include "internal.h"
|
|
|
|
void unlock_page(struct page *page)
|
|
{
|
|
return folio_unlock(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(unlock_page);
|
|
|
|
void end_page_writeback(struct page *page)
|
|
{
|
|
return folio_end_writeback(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(end_page_writeback);
|
|
|
|
void wait_on_page_writeback(struct page *page)
|
|
{
|
|
return folio_wait_writeback(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL_GPL(wait_on_page_writeback);
|
|
|
|
void mark_page_accessed(struct page *page)
|
|
{
|
|
folio_mark_accessed(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(mark_page_accessed);
|
|
|
|
void set_page_writeback(struct page *page)
|
|
{
|
|
folio_start_writeback(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(set_page_writeback);
|
|
|
|
/* Read the comment above folio_mark_dirty() regarding required locks! */
|
|
bool set_page_dirty(struct page *page)
|
|
{
|
|
return folio_mark_dirty(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(set_page_dirty);
|
|
|
|
int set_page_dirty_lock(struct page *page)
|
|
{
|
|
return folio_mark_dirty_lock(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(set_page_dirty_lock);
|
|
|
|
bool clear_page_dirty_for_io(struct page *page)
|
|
{
|
|
return folio_clear_dirty_for_io(page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(clear_page_dirty_for_io);
|
|
|
|
bool redirty_page_for_writepage(struct writeback_control *wbc,
|
|
struct page *page)
|
|
{
|
|
return folio_redirty_for_writepage(wbc, page_folio(page));
|
|
}
|
|
EXPORT_SYMBOL(redirty_page_for_writepage);
|
|
|
|
int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
|
|
pgoff_t index, gfp_t gfp)
|
|
{
|
|
return filemap_add_folio(mapping, page_folio(page), index, gfp);
|
|
}
|
|
EXPORT_SYMBOL(add_to_page_cache_lru);
|
|
|
|
noinline
|
|
struct page *pagecache_get_page(struct address_space *mapping, pgoff_t index,
|
|
fgf_t fgp_flags, gfp_t gfp)
|
|
{
|
|
struct folio *folio;
|
|
|
|
folio = __filemap_get_folio(mapping, index, fgp_flags, gfp);
|
|
if (IS_ERR(folio))
|
|
return NULL;
|
|
return folio_file_page(folio, index);
|
|
}
|
|
EXPORT_SYMBOL(pagecache_get_page);
|