[v2,0/2] mm/migrate: Fix writable pte for read migration entry

Message

Peter Xu Nov. 10, 2022, 8:31 p.m. UTC

v2:
- Replace WARN_ON_ONCE with VM_WARN_ON_ONCE in patch 2 [Nadav]

This comes from a report from Ives on using uffd-wp on shmem.  More
information can be found in patch 1 commit message.

Patch 2 added some more sanity check when walking pgtables and when we
convert the ptes into other forms e.g. for migration and swap.  It will
make the error trigger even earlier than the user could notice, meanwhile
nail down the case if it's a wrong pgtable setup.

Ives, I only attached the reported-by tag for you but not tested-by because
the fix patch (patch 1) has a slight change compared to what I sent you
before, but hopefully it should also work for you.  If you want, feel free
to reply directly here if the patch also works for you.

We probably need patch 1 for stable (5.19+).  Please have a look, thanks.

Peter Xu (2):
  mm/migrate: Fix read-only page got writable when recover pte
  mm/uffd: Sanity check write bit for uffd-wp protected ptes

 arch/x86/include/asm/pgtable.h | 16 +++++++++++++++-
 mm/migrate.c                   |  8 +++++++-
 2 files changed, 22 insertions(+), 2 deletions(-)