Linus Torvalds a95a24fcae mm: avoid leaving partial pfn mappings around in error case ... commit 79a61cc3fc upstream. As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw mapping of PFNs with no reference counting of a 'struct page'. That's all very much intentional, but it does mean that it's easy to mess up the cleanup in case of errors. Yes, a failed mmap() will always eventually clean up any partial mappings, but without any explicit lifetime in the page table mapping itself, it's very easy to do the error handling in the wrong order. In particular, it's easy to mistakenly free the physical backing store before the page tables are actually cleaned up and (temporarily) have stale dangling PTE entries. To make this situation less error-prone, just make sure that any partial pfn mapping is torn down early, before any other error handling. Reported-and-tested-by: Jann Horn <jannh@google.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Simona Vetter <simona.vetter@ffwll.ch> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-09-18 19:24:07 +02:00
..
damon	mm/damon/core: merge regions aggressively when max_nr_regions is unmet	2024-07-18 13:21:24 +02:00
kasan	kasan/test: avoid gcc warning for intentional overflow	2024-04-03 15:28:20 +02:00
kfence	LoongArch changes for v6.6	2023-09-08 12:16:52 -07:00
kmsan	kmsan: do not wipe out origin when doing partial unpoisoning	2024-06-16 13:47:41 +02:00
backing-dev.c	blk-wbt: Fix detection of dirty-throttled tasks	2024-02-23 09:25:16 +01:00
balloon_compaction.c
bootmem_info.c
cma_debug.c
cma_sysfs.c
cma.c	mm/cma: drop incorrect alignment check in cma_init_reserved_mem	2024-06-16 13:47:42 +02:00
cma.h
compaction.c	mm, treewide: introduce NR_PAGE_ORDERS	2024-05-02 16:32:41 +02:00
debug_page_alloc.c
debug_page_ref.c
debug_vm_pgtable.c	mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick	2024-08-19 06:04:31 +02:00
debug.c
dmapool_test.c
dmapool.c
early_ioremap.c
fadvise.c	mm: remove unnecessary pagevec includes	2023-06-23 16:59:31 -07:00
fail_page_alloc.c
failslab.c
filemap.c	mm: page_ref: remove folio_try_get_rcu()	2024-07-25 09:50:56 +02:00
folio-compat.c	filemap: Add fgf_t typedef	2023-07-24 18:04:30 -04:00
gup_test.c	Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.	2023-06-23 16:58:19 -07:00
gup_test.h
gup.c	mm: gup: stop abusing try_grab_folio	2024-08-19 06:04:24 +02:00
highmem.c	mm: ptep_get() conversion	2023-06-19 16:19:25 -07:00
hmm.c	mm: enable page walking API to lock vmas during the walk	2023-08-21 13:07:20 -07:00
huge_memory.c	mm/numa: no task_numa_fault() call if PMD is changed	2024-08-29 17:33:58 +02:00
hugetlb_cgroup.c
hugetlb_vmemmap.c	mm: hugetlb_vmemmap: fix a race between vmemmap pmd split	2023-08-18 10:12:14 -07:00
hugetlb_vmemmap.h
hugetlb.c	mm: gup: stop abusing try_grab_folio	2024-08-19 06:04:24 +02:00
hwpoison-inject.c
init-mm.c	mm: move dummy_vm_ops out of a header	2023-08-21 13:37:46 -07:00
internal.h	mm: gup: stop abusing try_grab_folio	2024-08-19 06:04:24 +02:00
interval_tree.c
io-mapping.c
ioremap.c	mm: ioremap: remove unneeded ioremap_allowed and iounmap_allowed	2023-08-18 10:12:36 -07:00
Kconfig	mm: restrict the pcp batch scale factor to avoid too long latency	2024-08-11 12:47:16 +02:00
Kconfig.debug
khugepaged.c	- Some swap cleanups from Ma Wupeng ("fix WARN_ON in add_to_avail_list")	2023-08-29 14:25:26 -07:00
kmemleak.c	mm/kmemleak: move up cond_resched() call in page scanning loop	2023-09-02 15:17:34 -07:00
ksm.c	mm/ksm: fix ksm_zero_pages accounting	2024-06-16 13:47:41 +02:00
list_lru.c
maccess.c
madvise.c	mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly	2024-05-02 16:32:40 +02:00
Makefile	- Some swap cleanups from Ma Wupeng ("fix WARN_ON in add_to_avail_list")	2023-08-29 14:25:26 -07:00
mapping_dirty_helpers.c	mm: fix clean_record_shared_mapping_range kernel-doc	2023-08-24 16:20:30 -07:00
memblock.c	x86/numa: Fix the address overlap check in numa_fill_memblks()	2024-03-01 13:35:06 +01:00
memcontrol.c	memcg_write_event_control(): fix a user-triggerable oops	2024-08-29 17:33:16 +02:00
memfd.c	revert "memfd: improve userspace warnings for missing exec-related flags".	2023-09-05 11:11:52 -07:00
memory_hotplug.c	x86/kaslr: Expose and use the end of the physical memory address space	2024-09-12 11:11:25 +02:00
memory-failure.c	mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu	2024-08-29 17:33:15 +02:00
memory-tiers.c	memory tier: use helper macro __ATTR_RW()	2023-08-18 10:12:38 -07:00
memory.c	mm: avoid leaving partial pfn mappings around in error case	2024-09-18 19:24:07 +02:00
mempolicy.c	mm/numa_balancing: teach mpol_to_str about the balancing mode	2024-08-03 08:54:25 +02:00
mempool.c
memremap.c
memtest.c	memtest: use {READ,WRITE}_ONCE in memory scanning	2024-04-03 15:28:33 +02:00
migrate_device.c	Add x86 shadow stack support	2023-08-31 12:20:12 -07:00
migrate.c	mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index	2024-03-15 10:48:14 -04:00
mincore.c	mm: enable page walking API to lock vmas during the walk	2023-08-21 13:07:20 -07:00
mlock.c	merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes	2023-08-21 14:26:20 -07:00
mm_init.c	efi: disable mirror feature during crashkernel	2024-01-31 16:18:56 -08:00
mm_slot.h
mmap_lock.c	mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer	2024-08-03 08:54:12 +02:00
mmap.c	mm, mmap: fix vma_merge() case 7 with vma_ops->close	2024-04-03 15:28:40 +02:00
mmu_gather.c	mm: fix kernel-doc warning from tlb_flush_rmaps()	2023-08-24 16:20:30 -07:00
mmu_notifier.c	mmu_notifiers: rename invalidate_range notifier	2023-08-18 10:12:41 -07:00
mmzone.c
mprotect.c	Add x86 shadow stack support	2023-08-31 12:20:12 -07:00
mremap.c	vm: fix move_vma() memory accounting being off	2023-09-16 15:23:31 -07:00
msync.c
nommu.c	Add x86 shadow stack support	2023-08-31 12:20:12 -07:00
oom_kill.c	mm: remove redundant K() macro definition	2023-08-21 13:37:44 -07:00
page_alloc.c	mm: fix endless reclaim on machines with unaccepted memory	2024-08-29 17:33:42 +02:00
page_counter.c
page_ext.c	mm/page_ext: move functions around for minor cleanups to page_ext	2023-08-18 10:12:31 -07:00
page_idle.c
page_io.c	zswap: make zswap_load() take a folio	2023-08-21 13:37:27 -07:00
page_isolation.c	mm/hugetlb: get rid of page_hstate()	2023-08-18 10:12:39 -07:00
page_owner.c	mm/page_ext: use page_ext_data helper in page_owner	2023-08-21 13:37:27 -07:00
page_poison.c	mm/page_poison: remove unused page_ext.h from page_poison	2023-08-21 13:37:30 -07:00
page_reporting.c	mm, treewide: introduce NR_PAGE_ORDERS	2024-05-02 16:32:41 +02:00
page_reporting.h
page_table_check.c	mm/page_table_check: support userfault wr-protect entries	2024-08-19 06:04:29 +02:00
page_vma_mapped.c	mm: correct stale comment of function check_pte	2023-08-18 10:12:13 -07:00
page-writeback.c	Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"	2024-07-11 12:49:16 +02:00
pagewalk.c	mm/pagewalk: fix bootstopping regression from extra pte_unmap()	2023-09-02 08:39:21 -07:00
percpu-internal.h	percpu-internal/pcpu_chunk: re-layout pcpu_chunk structure to reduce false sharing	2023-06-19 16:19:29 -07:00
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c	mm: Introduce flush_cache_vmap_early()	2024-02-16 19:10:52 +01:00
pgalloc-track.h
pgtable-generic.c	mm: fix race between __split_huge_pmd_locked() and GUP-fast	2024-06-16 13:47:40 +02:00
process_vm_access.c
ptdump.c	mm: ptdump should use ptep_get_lockless()	2023-06-19 16:19:24 -07:00
readahead.c	mm: use memalloc_nofs_save() in page_cache_ra_order()	2024-05-17 12:02:36 +02:00
rmap.c	mm: hugetlb: add huge page size param to set_huge_pte_at()	2023-09-29 17:20:47 -07:00
rodata_test.c
secretmem.c	mm/secretmem: use a folio in secretmem_fault()	2023-08-21 13:38:02 -07:00
shmem_quota.c	tmpfs: fix race on handling dquot rbtree	2024-04-03 15:28:54 +02:00
shmem.c	mm/shmem: disable PMD-sized page cache if needed	2024-07-18 13:21:24 +02:00
show_mem.c	mm, treewide: introduce NR_PAGE_ORDERS	2024-05-02 16:32:41 +02:00
shrinker_debug.c	Revert "mm: shrinkers: make count and scan in shrinker debugfs lockless"	2023-06-19 13:19:34 -07:00
shuffle.c
shuffle.h
slab_common.c	mm: Remove kmem_valid_obj()	2024-08-29 17:33:23 +02:00
slab.c	Randomized slab caches for kmalloc()	2023-07-18 10:07:47 +02:00
slab.h	Randomized slab caches for kmalloc()	2023-07-18 10:07:47 +02:00
slub.c	mm/slub: remove freelist_dereference()	2023-07-14 09:57:21 +02:00
sparse-vmemmap.c	mm/vmemmap: allow architectures to override how vmemmap optimization works	2023-08-18 10:12:53 -07:00
sparse.c	x86/kaslr: Expose and use the end of the physical memory address space	2024-09-12 11:11:25 +02:00
swap_cgroup.c
swap_slots.c
swap_state.c	mm/swap: inline folio_set_swap_entry() and folio_swap_entry()	2023-08-24 16:20:28 -07:00
swap.c	mm: remove references to pagevec	2023-06-23 16:59:30 -07:00
swap.h	mm/swap: fix race when skipping swapcache	2024-03-01 13:35:00 +01:00
swapfile.c	mm: swap: fix race between free_swap_and_cache() and swapoff()	2024-04-03 15:28:27 +02:00
truncate.c	mm: Fix missing folio invalidation calls during truncation	2024-09-04 13:28:23 +02:00
usercopy.c
userfaultfd.c	userfaultfd: fix checks for huge PMDs	2024-09-12 11:11:27 +02:00
util.c	mm: Remove kmem_valid_obj()	2024-08-29 17:33:23 +02:00
vmalloc.c	mm: vmalloc: ensure vmap_block is initialised before adding to queue	2024-09-12 11:11:27 +02:00
vmpressure.c	net-memcg: Fix scope of sockmem pressure indicators	2023-08-16 12:21:32 +01:00
vmscan.c	Revert "mm: skip CMA pages when they are not available"	2024-09-12 11:11:42 +02:00
vmstat.c	mm, treewide: introduce NR_PAGE_ORDERS	2024-05-02 16:32:41 +02:00
workingset.c	mm: ratelimit stat flush from workingset shrinker	2024-06-16 13:47:31 +02:00
z3fold.c	mm/z3fold: remove obsolete comment for struct z3fold_pool	2023-08-21 13:37:51 -07:00
zbud.c	mm: zswap: remove shrink from zpool interface	2023-06-19 16:19:27 -07:00
zpool.c	mm: zswap: remove shrink from zpool interface	2023-06-19 16:19:27 -07:00
zsmalloc.c	merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes	2023-08-21 14:26:20 -07:00
zswap.c	mm: zswap: fix missing folio cleanup in writeback race path	2024-03-01 13:35:10 +01:00