5 files changed, 13 insertions, 11 deletions

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 3e8807e0b9d2..040a04a88996 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1517,7 +1517,7 @@ static inline int pte_devmap(pte_t pte)
 }
 #endif
 
-int vma_wants_writenotify(struct vm_area_struct *vma);
+int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot);
 
 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
                                spinlock_t **ptl);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 12b9f1a39b63..cdcd25cb30fe 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1620,7 +1620,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                         if (soft_dirty)
                                 entry = pte_swp_mksoft_dirty(entry);
                 } else {
-                        entry = mk_pte(page + i, vma->vm_page_prot);
+                        entry = mk_pte(page + i, READ_ONCE(vma->vm_page_prot));
                         entry = maybe_mkwrite(entry, vma);
                         if (!write)
                                 entry = pte_wrprotect(entry);
diff --git a/mm/migrate.c b/mm/migrate.c
index f7ee04a5ae27..99250aee1ac1 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -234,7 +234,7 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
                 goto unlock;
 
         get_page(new);
-        pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
+        pte = pte_mkold(mk_pte(new, READ_ONCE(vma->vm_page_prot)));
         if (pte_swp_soft_dirty(*ptep))
                 pte = pte_mksoft_dirty(pte);
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 7a0707a48047..b3b74cc705ae 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -116,13 +116,15 @@ static pgprot_t vm_pgprot_modify(pgprot_t oldprot, unsigned long vm_flags)
 void vma_set_page_prot(struct vm_area_struct *vma)
 {
         unsigned long vm_flags = vma->vm_flags;
+        pgprot_t vm_page_prot;
 
-        vma->vm_page_prot = vm_pgprot_modify(vma->vm_page_prot, vm_flags);
-        if (vma_wants_writenotify(vma)) {
+        vm_page_prot = vm_pgprot_modify(vma->vm_page_prot, vm_flags);
+        if (vma_wants_writenotify(vma, vm_page_prot)) {
                 vm_flags &= ~VM_SHARED;
-                vma->vm_page_prot = vm_pgprot_modify(vma->vm_page_prot,
-                                                     vm_flags);
+                vm_page_prot = vm_pgprot_modify(vm_page_prot, vm_flags);
         }
+        /* remove_protection_ptes reads vma->vm_page_prot without mmap_sem */
+        WRITE_ONCE(vma->vm_page_prot, vm_page_prot);
 }
 
 /*
@@ -1386,7 +1388,7 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_arg_struct __user *, arg)
  * to the private version (using protection_map[] without the
  * VM_SHARED bit).
  */
-int vma_wants_writenotify(struct vm_area_struct *vma)
+int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot)
 {
         vm_flags_t vm_flags = vma->vm_flags;
         const struct vm_operations_struct *vm_ops = vma->vm_ops;
@@ -1401,8 +1403,8 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
 
         /* The open routine did something to the protections that pgprot_modify
          * won't preserve? */
-        if (pgprot_val(vma->vm_page_prot) !=
-            pgprot_val(vm_pgprot_modify(vma->vm_page_prot, vm_flags)))
+        if (pgprot_val(vm_page_prot) !=
+            pgprot_val(vm_pgprot_modify(vm_page_prot, vm_flags)))
                 return 0;
 
         /* Do we need to track softdirty? */
diff --git a/mm/mprotect.c b/mm/mprotect.c
index a4830f0325fe..063bbed22c7b 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -327,7 +327,7 @@ success:
          * held in write mode.
          */
         vma->vm_flags = newflags;
-        dirty_accountable = vma_wants_writenotify(vma);
+        dirty_accountable = vma_wants_writenotify(vma, vma->vm_page_prot);
         vma_set_page_prot(vma);
 
         change_protection(vma, start, end, vma->vm_page_prot,