mm/hugetlb: make hugetlb_follow_page_mask() safe to pmd unshare

Since hugetlb_follow_page_mask() walks the pgtable, it needs the vma lock
to make sure the pgtable page will not be freed concurrently.

Link: https://lkml.kernel.org/r/20221216155219.2043714-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7f9db1d9f6a58e11e2e1a8378aa012552621fc60..807edc1410e576fa54691e4206e012f4fe788b77 100644 (file)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6396,9 +6396,10 @@ struct page *hugetlb_follow_page_mask(struct vm_area_struct *vma,
        if (WARN_ON_ONCE(flags & FOLL_PIN))
                return NULL;
 
+       hugetlb_vma_lock_read(vma);
        pte = huge_pte_offset(mm, haddr, huge_page_size(h));
        if (!pte)
-               return NULL;
+               goto out_unlock;
 
        ptl = huge_pte_lock(h, mm, pte);
        entry = huge_ptep_get(pte);
@@ -6421,6 +6422,8 @@ struct page *hugetlb_follow_page_mask(struct vm_area_struct *vma,
        }
 out:
        spin_unlock(ptl);
+out_unlock:
+       hugetlb_vma_unlock_read(vma);
        return page;
 }