Thanks Ralph, please add:
Reviewed-by: Alistair Popple <apopple@xxxxxxxxxx>
However I think the fixes tag is wrong, see below.
Ralph Campbell <rcampbell@xxxxxxxxxx> writes:
> If hmm_range_fault() is called with the HMM_PFN_REQ_FAULT flag and a
> device private PTE is found, the hmm_range::dev_private_owner page is
> used to determine if the device private page should not be faulted in.
> However, if the device private page is not owned by the caller,
> hmm_range_fault() returns an error instead of calling migrate_to_ram()
> to fault in the page.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 76612d6ce4cc ("mm/hmm: reorganize how !pte_present is handled in hmm_vma_handle_pte()")
This should be 08ddddda667b ("mm/hmm: check the device private page owner in hmm_range_fault()")
> Signed-off-by: Ralph Campbell <rcampbell@xxxxxxxxxx>
> Reported-by: Felix Kuehling <felix.kuehling@xxxxxxx>
> ---
> mm/hmm.c | 19 ++++++++-----------
> 1 file changed, 8 insertions(+), 11 deletions(-)
>
> diff --git a/mm/hmm.c b/mm/hmm.c
> index 3fd3242c5e50..f2aa63b94d9b 100644
> --- a/mm/hmm.c
> +++ b/mm/hmm.c
> @@ -212,14 +212,6 @@ int hmm_vma_handle_pmd(struct mm_walk *walk, unsigned long addr,
> unsigned long end, unsigned long hmm_pfns[], pmd_t pmd);
> #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
>
> -static inline bool hmm_is_device_private_entry(struct hmm_range *range,
> - swp_entry_t entry)
> -{
> - return is_device_private_entry(entry) &&
> - pfn_swap_entry_to_page(entry)->pgmap->owner ==
> - range->dev_private_owner;
> -}
> -
> static inline unsigned long pte_to_hmm_pfn_flags(struct hmm_range *range,
> pte_t pte)
> {
> @@ -252,10 +244,12 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr,
> swp_entry_t entry = pte_to_swp_entry(pte);
>
> /*
> - * Never fault in device private pages, but just report
> - * the PFN even if not present.
> + * Don't fault in device private pages owned by the caller,
> + * just report the PFN.
> */
> - if (hmm_is_device_private_entry(range, entry)) {
> + if (is_device_private_entry(entry) &&
> + pfn_swap_entry_to_page(entry)->pgmap->owner ==
> + range->dev_private_owner) {
> cpu_flags = HMM_PFN_VALID;
> if (is_writable_device_private_entry(entry))
> cpu_flags |= HMM_PFN_WRITE;
> @@ -273,6 +267,9 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr,
> if (!non_swap_entry(entry))
> goto fault;
>
> + if (is_device_private_entry(entry))
> + goto fault;
> +
> if (is_device_exclusive_entry(entry))
> goto fault;
