Wupeng Ma 58a90db70a VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify ... commit 1bd6406fb5 upstream. During our test, it is found that a warning can be trigger in try_grab_folio as follow: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:try_grab_folio+0x106/0x130 Call Trace: <TASK> follow_huge_pmd+0x240/0x8e0 follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0 follow_pud_mask.constprop.0.isra.0+0x14a/0x170 follow_page_mask+0x1c2/0x1f0 __get_user_pages+0x176/0x950 __gup_longterm_locked+0x15b/0x1060 ? gup_fast+0x120/0x1f0 gup_fast_fallback+0x17e/0x230 get_user_pages_fast+0x5f/0x80 vmci_host_unlocked_ioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]--- Digging into the source, context->notify_page may init by get_user_pages_fast and can be seen in vmci_ctx_unset_notify which will try to put_page. However get_user_pages_fast is not finished here and lead to following try_grab_folio warning. The race condition is shown as follow: cpu0 cpu1 vmci_host_do_set_notify vmci_host_setup_notify get_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page); lockless_pages_from_mm gup_pgd_range gup_huge_pmd // update &context->notify_page vmci_host_do_set_notify vmci_ctx_unset_notify notify_page = context->notify_page; if (notify_page) put_page(notify_page); // page is freed __gup_longterm_locked __get_user_pages follow_trans_huge_pmd try_grab_folio // warn here To slove this, use local variable page to make notify_page can be seen after finish get_user_pages_fast. Fixes: a1d88436d5 ("VMCI: Fix two UVA mapping bugs") Cc: stable <stable@kernel.org> Closes: https://lore.kernel.org/all/e91da589-ad57-3969-d979-879bbd10dddd@huawei.com/ Signed-off-by: Wupeng Ma <mawupeng1@huawei.com> Link: https://lore.kernel.org/r/20250510033040.901582-1-mawupeng1@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-06-27 11:07:25 +01:00
..
altera-stapl
bcm-vk
c2port
cardreader	Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"	2025-03-13 12:53:19 +01:00
cb710
cxl
echo
eeprom	eeprom: digsy_mtc: Make GPIO lookup table match the device	2025-03-13 12:53:22 +01:00
genwqe
habanalabs
ibmasm
lis3lv02d
lkdtm	objtool, lkdtm: Obfuscate the do_nothing() pointer	2025-05-02 07:47:03 +02:00
mchp_pci1xxxx	misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack	2025-05-02 07:46:58 +02:00
mei	mei: me: add panther lake H DID	2025-05-02 07:46:57 +02:00
ocxl
pvpanic
sgi-gru
sgi-xp
ti-st
uacce
vmw_vmci	VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify	2025-06-27 11:07:25 +01:00
ad525x_dpot-i2c.c
ad525x_dpot-spi.c
ad525x_dpot.c
ad525x_dpot.h
apds990x.c
apds9802als.c
atmel-ssc.c
bh1770glc.c
cs5535-mfgpt.c
ds1682.c
dummy-irq.c
dw-xdata-pcie.c
enclosure.c
fastrpc.c	misc: fastrpc: Fix copy buffer page size	2025-02-21 13:49:52 +01:00
gehc-achc.c
hi6421v600-irq.c
hisi_hikey_usb.c
hmc6352.c
hpilo.c
hpilo.h
ibmvmc.c
ibmvmc.h
ics932s401.c
isl29003.c
isl29020.c
Kconfig
kgdbts.c
lattice-ecp3-config.c
Makefile
open-dice.c
pch_phub.c
pci_endpoint_test.c	misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type	2025-04-25 10:44:01 +02:00
phantom.c
qcom-coincell.c
sram-exec.c
sram.c
sram.h
tifm_7xx1.c
tifm_core.c
tsl2550.c
vcpu_stall_detector.c
vmw_balloon.c
xilinx_sdfec.c