[PATCH] lock PTE before updating it in 440/BookE page fault handler

Fix 44x and BookE page fault handler to correctly lock PTE before
trying to pte_update() it, otherwise this PTE might be swapped out
after pte_present() check but before pte_uptdate() call, resulting in
corrupted PTE. This can happen with enabled preemption and low memory
condition.

Signed-off-by: Eugene Surovegin <ebs@ebshome.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

1 files changed, 17 insertions, 13 deletions

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index ec4adcb4bc28..5aea0909a5ec 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -267,25 +267,29 @@ good_area:
 #endif
 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
                 pte_t *ptep;
+                pmd_t *pmdp;
 
                 /* Since 4xx/Book-E supports per-page execute permission,
                  * we lazily flush dcache to icache. */
                 ptep = NULL;
-                if (get_pteptr(mm, address, &ptep) && pte_present(*ptep)) {
-                        struct page *page = pte_page(*ptep);
-
-                        if (! test_bit(PG_arch_1, &page->flags)) {
-                                flush_dcache_icache_page(page);
-                                set_bit(PG_arch_1, &page->flags);
+                if (get_pteptr(mm, address, &ptep, &pmdp)) {
+                        spinlock_t *ptl = pte_lockptr(mm, pmdp);
+                        spin_lock(ptl);
+                        if (pte_present(*ptep)) {
+                                struct page *page = pte_page(*ptep);
+
+                                if (!test_bit(PG_arch_1, &page->flags)) {
+                                        flush_dcache_icache_page(page);
+                                        set_bit(PG_arch_1, &page->flags);
+                                }
+                                pte_update(ptep, 0, _PAGE_HWEXEC);
+                                _tlbie(address);
+                                pte_unmap_unlock(ptep, ptl);
+                                up_read(&mm->mmap_sem);
+                                return 0;
                         }
-                        pte_update(ptep, 0, _PAGE_HWEXEC);
-                        _tlbie(address);
-                        pte_unmap(ptep);
-                        up_read(&mm->mmap_sem);
-                        return 0;
+                        pte_unmap_unlock(ptep, ptl);
                 }
-                if (ptep != NULL)
-                        pte_unmap(ptep);
 #endif
         /* a write */
         } else if (is_write) {