Patch "fbdev: defio: fix the pagelist corruption" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    fbdev: defio: fix the pagelist corruption

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fbdev-defio-fix-the-pagelist-corruption.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d74bedcc06ac6927a4c678e4bc57cf6862734297
Author: Chuansheng Liu <chuansheng.liu@xxxxxxxxx>
Date:   Fri Mar 18 08:50:03 2022 +0800

    fbdev: defio: fix the pagelist corruption
    
    [ Upstream commit 856082f021a28221db2c32bd0531614a8382be67 ]
    
    Easily hit the below list corruption:
    ==
    list_add corruption. prev->next should be next (ffffffffc0ceb090), but
    was ffffec604507edc8. (prev=ffffec604507edc8).
    WARNING: CPU: 65 PID: 3959 at lib/list_debug.c:26
    __list_add_valid+0x53/0x80
    CPU: 65 PID: 3959 Comm: fbdev Tainted: G     U
    RIP: 0010:__list_add_valid+0x53/0x80
    Call Trace:
     <TASK>
     fb_deferred_io_mkwrite+0xea/0x150
     do_page_mkwrite+0x57/0xc0
     do_wp_page+0x278/0x2f0
     __handle_mm_fault+0xdc2/0x1590
     handle_mm_fault+0xdd/0x2c0
     do_user_addr_fault+0x1d3/0x650
     exc_page_fault+0x77/0x180
     ? asm_exc_page_fault+0x8/0x30
     asm_exc_page_fault+0x1e/0x30
    RIP: 0033:0x7fd98fc8fad1
    ==
    
    Figure out the race happens when one process is adding &page->lru into
    the pagelist tail in fb_deferred_io_mkwrite(), another process is
    re-initializing the same &page->lru in fb_deferred_io_fault(), which is
    not protected by the lock.
    
    This fix is to init all the page lists one time during initialization,
    it not only fixes the list corruption, but also avoids INIT_LIST_HEAD()
    redundantly.
    
    V2: change "int i" to "unsigned int i" (Geert Uytterhoeven)
    
    Signed-off-by: Chuansheng Liu <chuansheng.liu@xxxxxxxxx>
    Fixes: 105a940416fc ("fbdev/defio: Early-out if page is already enlisted")
    Cc: Thomas Zimmermann <tzimmermann@xxxxxxx>
    Cc: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
    Reviewed-by: Javier Martinez Canillas <javierm@xxxxxxxxxx>
    Reviewed-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
    Signed-off-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/20220318005003.51810-1-chuansheng.liu@xxxxxxxxx
    Stable-dep-of: 33cd6ea9c067 ("fbdev: flush deferred IO before closing")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
index bead69f39ffc..0da3dfe35233 100644
--- a/drivers/video/fbdev/core/fb_defio.c
+++ b/drivers/video/fbdev/core/fb_defio.c
@@ -59,7 +59,6 @@ static vm_fault_t fb_deferred_io_fault(struct vm_fault *vmf)
 		printk(KERN_ERR "no mapping available\n");
 
 	BUG_ON(!page->mapping);
-	INIT_LIST_HEAD(&page->lru);
 	page->index = vmf->pgoff;
 
 	vmf->page = page;
@@ -216,6 +215,8 @@ static void fb_deferred_io_work(struct work_struct *work)
 void fb_deferred_io_init(struct fb_info *info)
 {
 	struct fb_deferred_io *fbdefio = info->fbdefio;
+	struct page *page;
+	unsigned int i;
 
 	BUG_ON(!fbdefio);
 	mutex_init(&fbdefio->lock);
@@ -223,6 +224,12 @@ void fb_deferred_io_init(struct fb_info *info)
 	INIT_LIST_HEAD(&fbdefio->pagelist);
 	if (fbdefio->delay == 0) /* set a default of 1 s */
 		fbdefio->delay = HZ;
+
+	/* initialize all the page lists one time */
+	for (i = 0; i < info->fix.smem_len; i += PAGE_SIZE) {
+		page = fb_deferred_io_page(info, i);
+		INIT_LIST_HEAD(&page->lru);
+	}
 }
 EXPORT_SYMBOL_GPL(fb_deferred_io_init);