[RFC PATCH 1/1] mm/vmalloc: Modify permission reset procedure to avoid invalid access

[Leo Yu-Chi Liang]

The previous reset procedure is
1. Set direct map attribute to invalid
2. Flush TLB
3. Reset direct map attribute to default

It is possible that kernel forks another process
on another core that access the invalid mappings after
sync_kernel_mappings.

We could reproduce this scenario by running LTP/bpf_prog
multiple times on RV32 kernel on QEMU.

Therefore, the following procedure is proposed
to avoid mappings being invalid.
1. Reset direct map attribute to default
2. Flush TLB

Signed-off-by: Leo Yu-Chi Liang <ycliang@xxxxxxxxxxxxx>
---
 mm/vmalloc.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 45e1506d58c3..58ef2fc51e43 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -3248,14 +3248,9 @@ static void vm_reset_perms(struct vm_struct *area)
 		}
 	}
 
-	/*
-	 * Set direct map to something invalid so that it won't be cached if
-	 * there are any accesses after the TLB flush, then flush the TLB and
-	 * reset the direct map permissions to the default.
-	 */
-	set_area_direct_map(area, set_direct_map_invalid_noflush);
-	_vm_unmap_aliases(start, end, flush_dmap);
+	/* Reset direct map permissions to default, then flush the TLB */
 	set_area_direct_map(area, set_direct_map_default_noflush);
+	_vm_unmap_aliases(start, end, flush_dmap);
 }
 
 static void delayed_vfree_work(struct work_struct *w)
-- 
2.34.1