diff options
| author | Jann Horn <jannh@google.com> | 2026-08-10 20:10:01 +0200 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-08-24 18:43:19 -0700 |
| commit | 1dea8e081ec3833e5150250b9fa3afd0dc8768db (patch) | |
| tree | e741398749dd21df936f5b7e5d2c7f046785482f /include/linux | |
| parent | a8b5875741d416703e19ad8eeac6fce8a12bd6e4 (diff) | |
mm/page-writeback: document folio_mark_dirty() locking more explicitly
We have had bugs where set_page_dirty() was used on a page from GUP
without appropriate locking, leading to UAF, in:
- KVM, see
https://lore.kernel.org/r/20260810-x86-kvm-setpagedirty-v1-1-85f180892d4f@google.com
- i915, see commit 0d4bbe3d407f ("drm/i915/userptr: Try to acquire the
page lock around set_page_dirty()").
- VMCI, see commit 5a16c535409f ("VMCI: Use set_page_dirty_lock() when
unregistering guest memory")
- kpc2000 staging driver, see commit b6d13bd9f2c1 ("staging: kpc2000:
kpc_dma: Convert set_page_dirty() --> set_page_dirty_lock()")
I think set_page_dirty() and folio_mark_dirty() need more explicit
documentation on how they should be used with pages from GUP; so add a
comment on top of set_page_dirty() and make the comment above
folio_mark_dirty() more explicit.
Link: https://lore.kernel.org/20260810-set-page-dirty-warnings-v2-1-1bd40fadfacd@google.com
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions
