1 files changed, 23 insertions, 6 deletions

diff --git a/mm/memory.c b/mm/memory.c
index 109e9866237e..fa941b169071 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1458,14 +1458,19 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
 {
         struct page *old_page, *new_page;
         pte_t entry;
-        int reuse, ret = VM_FAULT_MINOR;
+        int reuse = 0, ret = VM_FAULT_MINOR;
+        struct page *dirty_page = NULL;
 
         old_page = vm_normal_page(vma, address, orig_pte);
         if (!old_page)
                 goto gotten;
 
-        if (unlikely((vma->vm_flags & (VM_SHARED|VM_WRITE)) ==
-                                (VM_SHARED|VM_WRITE))) {
+        /*
+         * Only catch write-faults on shared writable pages, read-only
+         * shared pages can get COWed by get_user_pages(.write=1, .force=1).
+         */
+        if (unlikely((vma->vm_flags & (VM_WRITE|VM_SHARED)) ==
+                                        (VM_WRITE|VM_SHARED))) {
                 if (vma->vm_ops && vma->vm_ops->page_mkwrite) {
                         /*
                          * Notify the address space that the page is about to
@@ -1494,13 +1499,12 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                         if (!pte_same(*page_table, orig_pte))
                                 goto unlock;
                 }
-
+                dirty_page = old_page;
+                get_page(dirty_page);
                 reuse = 1;
         } else if (PageAnon(old_page) && !TestSetPageLocked(old_page)) {
                 reuse = can_share_swap_page(old_page);
                 unlock_page(old_page);
-        } else {
-                reuse = 0;
         }
 
         if (reuse) {
@@ -1566,6 +1570,10 @@ gotten:
                 page_cache_release(old_page);
 unlock:
         pte_unmap_unlock(page_table, ptl);
+        if (dirty_page) {
+                set_page_dirty(dirty_page);
+                put_page(dirty_page);
+        }
         return ret;
 oom:
         if (old_page)
@@ -2098,6 +2106,7 @@ static int do_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
         unsigned int sequence = 0;
         int ret = VM_FAULT_MINOR;
         int anon = 0;
+        struct page *dirty_page = NULL;
 
         pte_unmap(page_table);
         BUG_ON(vma->vm_flags & VM_PFNMAP);
@@ -2192,6 +2201,10 @@ retry:
                 } else {
                         inc_mm_counter(mm, file_rss);
                         page_add_file_rmap(new_page);
+                        if (write_access) {
+                                dirty_page = new_page;
+                                get_page(dirty_page);
+                        }
                 }
         } else {
                 /* One of our sibling threads was faster, back out. */
@@ -2204,6 +2217,10 @@ retry:
         lazy_mmu_prot_update(entry);
 unlock:
         pte_unmap_unlock(page_table, ptl);
+        if (dirty_page) {
+                set_page_dirty(dirty_page);
+                put_page(dirty_page);
+        }
         return ret;
 oom:
         page_cache_release(new_page);