From: Mike Rapoport <rppt@xxxxxxxxxxxxx>
The check in gup_pte_range() whether a page belongs to a secretmem mapping
is performed before grabbing the page reference.
To avoid potential race move the check after try_grab_compound_head().
Signed-off-by: Mike Rapoport <rppt@xxxxxxxxxxxxx>
---
mm/gup.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/mm/gup.c b/mm/gup.c
index c3a17b189064..6515f82b0f32 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2080,13 +2080,15 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
page = pte_page(pte);
- if (page_is_secretmem(page))
- goto pte_unmap;
-
head = try_grab_compound_head(page, 1, flags);
if (!head)
goto pte_unmap;
+ if (unlikely(page_is_secretmem(page))) {
+ put_compound_head(head, 1, flags);
+ goto pte_unmap;
+ }
+
if (unlikely(pte_val(pte) != pte_val(*ptep))) {
put_compound_head(head, 1, flags);
goto pte_unmap;
--
2.28.0
