On Mon, Aug 29, 2022 at 05:52:38PM +0200, Gerald Schaefer wrote:
> commit 41ac42f137080bc230b5882e3c88c392ab7f2d32 upstream.
>
> For non-protection pXd_none() page faults in do_dat_exception(), we
> call do_exception() with access == (VM_READ | VM_WRITE | VM_EXEC).
> In do_exception(), vma->vm_flags is checked against that before
> calling handle_mm_fault().
>
> Since commit 92f842eac7ee3 ("[S390] store indication fault optimization"),
> we call handle_mm_fault() with FAULT_FLAG_WRITE, when recognizing that
> it was a write access. However, the vma flags check is still only
> checking against (VM_READ | VM_WRITE | VM_EXEC), and therefore also
> calling handle_mm_fault() with FAULT_FLAG_WRITE in cases where the vma
> does not allow VM_WRITE.
>
> Fix this by changing access check in do_exception() to VM_WRITE only,
> when recognizing write access.
>
> Link: https://lkml.kernel.org/r/20220811103435.188481-3-david@xxxxxxxxxx
> Fixes: 92f842eac7ee3 ("[S390] store indication fault optimization")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Reported-by: David Hildenbrand <david@xxxxxxxxxx>
> Reviewed-by: Heiko Carstens <hca@xxxxxxxxxxxxx>
> Signed-off-by: Gerald Schaefer <gerald.schaefer@xxxxxxxxxxxxx>
> ---
> arch/s390/mm/fault.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
> index ba2f21873cbd..6fa4220e34b5 100644
> --- a/arch/s390/mm/fault.c
> +++ b/arch/s390/mm/fault.c
> @@ -409,7 +409,9 @@ static inline int do_exception(struct pt_regs *regs, int access)
> flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
> if (user_mode(regs))
> flags |= FAULT_FLAG_USER;
> - if (access == VM_WRITE || (trans_exc_code & store_indication) == 0x400)
> + if ((trans_exc_code & store_indication) == 0x400)
> + access = VM_WRITE;
> + if (access == VM_WRITE)
> flags |= FAULT_FLAG_WRITE;
> down_read(&mm->mmap_sem);
>
> --
> 2.34.1
>
all now queued up, thanks.
greg k-h
