From: John Hubbard jhubbard@nvidia.com

Provide a more capable variation of put_user_pages_dirty_lock(), and delete put_user_pages_dirty(). This is based on the following:

1. Lots of call sites become simpler if a bool is passed into put_user_page*(), instead of making the call site choose which put_user_page*() variant to call.

2. Christoph Hellwig's observation that set_page_dirty_lock() is usually correct, and set_page_dirty() is usually a bug, or at least questionable, within a put_user_page*() calling chain.

This leads to the following API choices:

* put_user_pages_dirty_lock(page, npages, make_dirty)

* There is no put_user_pages_dirty(). You have to hand code that, in the rare case that it's required.

Reviewed-by: Christoph Hellwig hch@lst.de Reviewed-by: Ira Weiny ira.weiny@intel.com

Cc: Matthew Wilcox willy@infradead.org Cc: Jan Kara jack@suse.cz Cc: Ira Weiny ira.weiny@intel.com Cc: Jason Gunthorpe jgg@ziepe.ca Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/infiniband/core/umem.c | 5 +- drivers/infiniband/hw/hfi1/user_pages.c | 5 +- drivers/infiniband/hw/qib/qib_user_pages.c | 13 +-- drivers/infiniband/hw/usnic/usnic_uiom.c | 5 +- drivers/infiniband/sw/siw/siw_mem.c | 19 +--- include/linux/mm.h | 5 +- mm/gup.c | 109 ++++++++------------- 7 files changed, 54 insertions(+), 107 deletions(-)

diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c index 08da840ed7ee..965cf9dea71a 100644 --- a/drivers/infiniband/core/umem.c +++ b/drivers/infiniband/core/umem.c @@ -54,10 +54,7 @@ static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int d

for_each_sg_page(umem->sg_head.sgl, &sg_iter, umem->sg_nents, 0) { page = sg_page_iter_page(&sg_iter); - if (umem->writable && dirty) - put_user_pages_dirty_lock(&page, 1); - else - put_user_page(page); + put_user_pages_dirty_lock(&page, 1, umem->writable && dirty); }

sg_free_table(&umem->sg_head); diff --git a/drivers/infiniband/hw/hfi1/user_pages.c b/drivers/infiniband/hw/hfi1/user_pages.c index b89a9b9aef7a..469acb961fbd 100644 --- a/drivers/infiniband/hw/hfi1/user_pages.c +++ b/drivers/infiniband/hw/hfi1/user_pages.c @@ -118,10 +118,7 @@ int hfi1_acquire_user_pages(struct mm_struct *mm, unsigned long vaddr, size_t np void hfi1_release_user_pages(struct mm_struct *mm, struct page **p, size_t npages, bool dirty) { - if (dirty) - put_user_pages_dirty_lock(p, npages); - else - put_user_pages(p, npages); + put_user_pages_dirty_lock(p, npages, dirty);

if (mm) { /* during close after signal, mm can be NULL */ atomic64_sub(npages, &mm->pinned_vm); diff --git a/drivers/infiniband/hw/qib/qib_user_pages.c b/drivers/infiniband/hw/qib/qib_user_pages.c index bfbfbb7e0ff4..26c1fb8d45cc 100644 --- a/drivers/infiniband/hw/qib/qib_user_pages.c +++ b/drivers/infiniband/hw/qib/qib_user_pages.c @@ -37,15 +37,6 @@

#include "qib.h"

-static void __qib_release_user_pages(struct page **p, size_t num_pages, - int dirty) -{ - if (dirty) - put_user_pages_dirty_lock(p, num_pages); - else - put_user_pages(p, num_pages); -} - /** * qib_map_page - a safety wrapper around pci_map_page() * @@ -124,7 +115,7 @@ int qib_get_user_pages(unsigned long start_page, size_t num_pages,

return 0; bail_release: - __qib_release_user_pages(p, got, 0); + put_user_pages_dirty_lock(p, got, false); bail: atomic64_sub(num_pages, &current->mm->pinned_vm); return ret; @@ -132,7 +123,7 @@ int qib_get_user_pages(unsigned long start_page, size_t num_pages,

void qib_release_user_pages(struct page **p, size_t num_pages) { - __qib_release_user_pages(p, num_pages, 1); + put_user_pages_dirty_lock(p, num_pages, true);

/* during close after signal, mm can be NULL */ if (current->mm) diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c index 0b0237d41613..62e6ffa9ad78 100644 --- a/drivers/infiniband/hw/usnic/usnic_uiom.c +++ b/drivers/infiniband/hw/usnic/usnic_uiom.c @@ -75,10 +75,7 @@ static void usnic_uiom_put_pages(struct list_head *chunk_list, int dirty) for_each_sg(chunk->page_list, sg, chunk->nents, i) { page = sg_page(sg); pa = sg_phys(sg); - if (dirty) - put_user_pages_dirty_lock(&page, 1); - else - put_user_page(page); + put_user_pages_dirty_lock(&page, 1, dirty); usnic_dbg("pa: %pa\n", &pa); } kfree(chunk); diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c index 67171c82b0c4..1e197753bf2f 100644 --- a/drivers/infiniband/sw/siw/siw_mem.c +++ b/drivers/infiniband/sw/siw/siw_mem.c @@ -60,20 +60,6 @@ struct siw_mem *siw_mem_id2obj(struct siw_device *sdev, int stag_index) return NULL; }

-static void siw_free_plist(struct siw_page_chunk *chunk, int num_pages, - bool dirty) -{ - struct page **p = chunk->plist; - - while (num_pages--) { - if (!PageDirty(*p) && dirty) - put_user_pages_dirty_lock(p, 1); - else - put_user_page(*p); - p++; - } -} - void siw_umem_release(struct siw_umem *umem, bool dirty) { struct mm_struct *mm_s = umem->owning_mm; @@ -82,8 +68,9 @@ void siw_umem_release(struct siw_umem *umem, bool dirty) for (i = 0; num_pages; i++) { int to_free = min_t(int, PAGES_PER_CHUNK, num_pages);

- siw_free_plist(&umem->page_chunk[i], to_free, - umem->writable && dirty); + put_user_pages_dirty_lock(umem->page_chunk[i].plist, + to_free, + umem->writable && dirty); kfree(umem->page_chunk[i].plist); num_pages -= to_free; } diff --git a/include/linux/mm.h b/include/linux/mm.h index 0334ca97c584..9759b6a24420 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1057,8 +1057,9 @@ static inline void put_user_page(struct page *page) put_page(page); }

-void put_user_pages_dirty(struct page **pages, unsigned long npages); -void put_user_pages_dirty_lock(struct page **pages, unsigned long npages); +void put_user_pages_dirty_lock(struct page **pages, unsigned long npages, + bool make_dirty); + void put_user_pages(struct page **pages, unsigned long npages);

#if defined(CONFIG_SPARSEMEM) && !defined(CONFIG_SPARSEMEM_VMEMMAP) diff --git a/mm/gup.c b/mm/gup.c index 98f13ab37bac..7f5737edb624 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -29,85 +29,62 @@ struct follow_page_context { unsigned int page_mask; };

-typedef int (*set_dirty_func_t)(struct page *page); - -static void __put_user_pages_dirty(struct page **pages, - unsigned long npages, - set_dirty_func_t sdf) -{ - unsigned long index; - - for (index = 0; index < npages; index++) { - struct page *page = compound_head(pages[index]); - - /* - * Checking PageDirty at this point may race with - * clear_page_dirty_for_io(), but that's OK. Two key cases: - * - * 1) This code sees the page as already dirty, so it skips - * the call to sdf(). That could happen because - * clear_page_dirty_for_io() called page_mkclean(), - * followed by set_page_dirty(). However, now the page is - * going to get written back, which meets the original - * intention of setting it dirty, so all is well: - * clear_page_dirty_for_io() goes on to call - * TestClearPageDirty(), and write the page back. - * - * 2) This code sees the page as clean, so it calls sdf(). - * The page stays dirty, despite being written back, so it - * gets written back again in the next writeback cycle. - * This is harmless. - */ - if (!PageDirty(page)) - sdf(page); - - put_user_page(page); - } -} - /** - * put_user_pages_dirty() - release and dirty an array of gup-pinned pages - * @pages: array of pages to be marked dirty and released. + * put_user_pages_dirty_lock() - release and optionally dirty gup-pinned pages + * @pages: array of pages to be put * @npages: number of pages in the @pages array. + * @make_dirty: whether to mark the pages dirty * * "gup-pinned page" refers to a page that has had one of the get_user_pages() * variants called on that page. * - * For each page in the @pages array, make that page (or its head page, if a - * compound page) dirty, if it was previously listed as clean. Then, release - * the page using put_user_page(). + * For each page in the @pages array, release the page. If @make_dirty is + * true, mark the page dirty prior to release. * * Please see the put_user_page() documentation for details. * - * set_page_dirty(), which does not lock the page, is used here. - * Therefore, it is the caller's responsibility to ensure that this is - * safe. If not, then put_user_pages_dirty_lock() should be called instead. + * set_page_dirty_lock() is used internally. If instead, set_page_dirty() is + * required, then the caller should a) verify that this is really correct, + * because _lock() is usually required, and b) hand code it: + * set_page_dirty_lock(), put_user_page(). * */ -void put_user_pages_dirty(struct page **pages, unsigned long npages) +void put_user_pages_dirty_lock(struct page **pages, unsigned long npages, + bool make_dirty) { - __put_user_pages_dirty(pages, npages, set_page_dirty); -} -EXPORT_SYMBOL(put_user_pages_dirty); + unsigned long index;

-/** - * put_user_pages_dirty_lock() - release and dirty an array of gup-pinned pages - * @pages: array of pages to be marked dirty and released. - * @npages: number of pages in the @pages array. - * - * For each page in the @pages array, make that page (or its head page, if a - * compound page) dirty, if it was previously listed as clean. Then, release - * the page using put_user_page(). - * - * Please see the put_user_page() documentation for details. - * - * This is just like put_user_pages_dirty(), except that it invokes - * set_page_dirty_lock(), instead of set_page_dirty(). - * - */ -void put_user_pages_dirty_lock(struct page **pages, unsigned long npages) -{ - __put_user_pages_dirty(pages, npages, set_page_dirty_lock); + if (!make_dirty) { + put_user_pages(pages, npages); + return; + } + + for (index = 0; index < npages; index++) { + struct page *page = compound_head(pages[index]); + /* + * Checking PageDirty at this point may race with + * clear_page_dirty_for_io(), but that's OK. Two key + * cases: + * + * 1) This code sees the page as already dirty, so it + * skips the call to set_page_dirty(). That could happen + * because clear_page_dirty_for_io() called + * page_mkclean(), followed by set_page_dirty(). + * However, now the page is going to get written back, + * which meets the original intention of setting it + * dirty, so all is well: clear_page_dirty_for_io() goes + * on to call TestClearPageDirty(), and write the page + * back. + * + * 2) This code sees the page as clean, so it calls + * set_page_dirty(). The page stays dirty, despite being + * written back, so it gets written back again in the + * next writeback cycle. This is harmless. + */ + if (!PageDirty(page)) + set_page_dirty_lock(page); + put_user_page(page); + } } EXPORT_SYMBOL(put_user_pages_dirty_lock);

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Acked-by: Björn Töpel bjorn.topel@intel.com Cc: Magnus Karlsson magnus.karlsson@intel.com Cc: David S. Miller davem@davemloft.net Cc: netdev@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- net/xdp/xdp_umem.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c index 83de74ca729a..17c4b3d3dc34 100644 --- a/net/xdp/xdp_umem.c +++ b/net/xdp/xdp_umem.c @@ -166,14 +166,7 @@ void xdp_umem_clear_dev(struct xdp_umem *umem)

static void xdp_umem_unpin_pages(struct xdp_umem *umem) { - unsigned int i; - - for (i = 0; i < umem->npgs; i++) { - struct page *page = umem->pgs[i]; - - set_page_dirty_lock(page); - put_page(page); - } + put_user_pages_dirty_lock(umem->pgs, umem->npgs, true);

kfree(umem->pgs); umem->pgs = NULL;

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Acked-by: Jeff Layton jlayton@kernel.org

Cc: Ilya Dryomov idryomov@gmail.com Cc: Sage Weil sage@redhat.com Cc: David S. Miller davem@davemloft.net Cc: ceph-devel@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- net/ceph/pagevec.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c index 64305e7056a1..c88fff2ab9bd 100644 --- a/net/ceph/pagevec.c +++ b/net/ceph/pagevec.c @@ -12,13 +12,7 @@

void ceph_put_page_vector(struct page **pages, int num_pages, bool dirty) { - int i; - - for (i = 0; i < num_pages; i++) { - if (dirty) - set_page_dirty_lock(pages[i]); - put_page(pages[i]); - } + put_user_pages_dirty_lock(pages, num_pages, dirty); kvfree(pages); } EXPORT_SYMBOL(ceph_put_page_vector);

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Joerg Roedel joro@8bytes.org Cc: Paolo Bonzini pbonzini@redhat.com Cc: Radim Krčmář rkrcmar@redhat.com Cc: Thomas Gleixner tglx@linutronix.de Cc: Ingo Molnar mingo@redhat.com Cc: Borislav Petkov bp@alien8.de Cc: H. Peter Anvin hpa@zytor.com Cc: x86@kernel.org Cc: kvm@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c index e8778ebb72e6..a0144a5ee325 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c @@ -686,7 +686,7 @@ static int etnaviv_gem_userptr_get_pages(struct etnaviv_gem_object *etnaviv_obj) ret = get_user_pages_fast(ptr, num_pages, !userptr->ro ? FOLL_WRITE : 0, pages); if (ret < 0) { - release_pages(pvec, pinned); + put_user_pages(pvec, pinned); kvfree(pvec); return ret; } @@ -710,7 +710,7 @@ static void etnaviv_gem_userptr_release(struct etnaviv_gem_object *etnaviv_obj) if (etnaviv_obj->pages) { int npages = etnaviv_obj->base.size >> PAGE_SHIFT;

- release_pages(etnaviv_obj->pages, npages); + put_user_pages(etnaviv_obj->pages, npages); kvfree(etnaviv_obj->pages); } }

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Alex Deucher alexander.deucher@amd.com Cc: Christian König christian.koenig@amd.com Cc: David (ChunMing) Zhou David1.Zhou@amd.com Cc: David Airlie airlied@linux.ie Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/gpu/drm/radeon/radeon_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c index fb3696bc616d..4c9943fa10df 100644 --- a/drivers/gpu/drm/radeon/radeon_ttm.c +++ b/drivers/gpu/drm/radeon/radeon_ttm.c @@ -540,7 +540,7 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_tt *ttm) kfree(ttm->sg);

release_pages: - release_pages(ttm->pages, pinned); + put_user_pages(ttm->pages, pinned); return r; }

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

This changes the release code slightly, because each page slot in the page_list[] array is no longer checked for NULL. However, that check was wrong anyway, because the get_user_pages() pattern of usage here never allowed for NULL entries within a range of pinned pages.

Acked-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

Cc: Frank Haverkamp haver@linux.vnet.ibm.com Cc: Guilherme G. Piccoli gpiccoli@linux.vnet.ibm.com Cc: Arnd Bergmann arnd@arndb.de Cc: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/misc/genwqe/card_utils.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c index 2e1c4d2905e8..2a888f31d2c5 100644 --- a/drivers/misc/genwqe/card_utils.c +++ b/drivers/misc/genwqe/card_utils.c @@ -517,24 +517,13 @@ int genwqe_free_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl) /** * genwqe_free_user_pages() - Give pinned pages back * - * Documentation of get_user_pages is in mm/gup.c: - * - * If the page is written to, set_page_dirty (or set_page_dirty_lock, - * as appropriate) must be called after the page is finished with, and - * before put_page is called. + * The pages may have been written to, so we call put_user_pages_dirty_lock(), + * rather than put_user_pages(). */ static int genwqe_free_user_pages(struct page **page_list, unsigned int nr_pages, int dirty) { - unsigned int i; - - for (i = 0; i < nr_pages; i++) { - if (page_list[i] != NULL) { - if (dirty) - set_page_dirty_lock(page_list[i]); - put_page(page_list[i]); - } - } + put_user_pages_dirty_lock(page_list, nr_pages, dirty); return 0; }

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Note that this effectively changes the code's behavior in qp_release_pages(): it now ultimately calls set_page_dirty_lock(), instead of set_page_dirty(). This is probably more accurate.

As Christoph Hellwig put it, "set_page_dirty() is only safe if we are dealing with a file backed page where we have reference on the inode it hangs off." [1]

[1] https://lore.kernel.org/r/20190723153640.GB720@lst.de

Cc: Arnd Bergmann arnd@arndb.de Cc: Al Viro viro@zeniv.linux.org.uk Cc: Gustavo A. R. Silva gustavo@embeddedor.com Cc: Kees Cook keescook@chromium.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/misc/vmw_vmci/vmci_context.c | 2 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 11 ++--------- 2 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c index 16695366ec92..9daa52ee63b7 100644 --- a/drivers/misc/vmw_vmci/vmci_context.c +++ b/drivers/misc/vmw_vmci/vmci_context.c @@ -587,7 +587,7 @@ void vmci_ctx_unset_notify(struct vmci_ctx *context)

if (notify_page) { kunmap(notify_page); - put_page(notify_page); + put_user_page(notify_page); } }

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c index 8531ae781195..e5434551d0ef 100644 --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c @@ -626,15 +626,8 @@ static void qp_release_queue_mutex(struct vmci_queue *queue) static void qp_release_pages(struct page **pages, u64 num_pages, bool dirty) { - int i; - - for (i = 0; i < num_pages; i++) { - if (dirty) - set_page_dirty(pages[i]); - - put_page(pages[i]); - pages[i] = NULL; - } + put_user_pages_dirty_lock(pages, num_pages, dirty); + memset(pages, 0, num_pages * sizeof(struct page *)); }

/*

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: David S. Miller davem@davemloft.net Cc: Jonathan Helman jonathan.helman@oracle.com Cc: Rob Gardner rob.gardner@oracle.com Cc: Andy Shevchenko andy.shevchenko@gmail.com Cc: Jonathan Corbet corbet@lwn.net Cc: Wei Yongjun weiyongjun1@huawei.com Cc: Mauro Carvalho Chehab mchehab+samsung@kernel.org Cc: sparclinux@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/sbus/char/oradax.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/sbus/char/oradax.c b/drivers/sbus/char/oradax.c index 8af216287a84..029e619992fc 100644 --- a/drivers/sbus/char/oradax.c +++ b/drivers/sbus/char/oradax.c @@ -412,7 +412,7 @@ static void dax_unlock_pages(struct dax_ctx *ctx, int ccb_index, int nelem) dax_dbg("freeing page %p", p); if (j == OUT) set_page_dirty(p); - put_page(p); + put_user_page(p); ctx->pages[i][j] = NULL; } }

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Acked-by: Jens Wiklander jens.wiklander@linaro.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/tee/tee_shm.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 2da026fd12c9..c967d0420b67 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -31,16 +31,13 @@ static void tee_shm_release(struct tee_shm *shm)

poolm->ops->free(poolm, shm); } else if (shm->flags & TEE_SHM_REGISTER) { - size_t n; int rc = teedev->desc->ops->shm_unregister(shm->ctx, shm);

if (rc) dev_err(teedev->dev.parent, "unregister shm %p failed: %d", shm, rc);

- for (n = 0; n < shm->num_pages; n++) - put_page(shm->pages[n]); - + put_user_pages(shm->pages, shm->num_pages); kfree(shm->pages); }

@@ -313,16 +310,13 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, return shm; err: if (shm) { - size_t n; - if (shm->id >= 0) { mutex_lock(&teedev->mutex); idr_remove(&teedev->idr, shm->id); mutex_unlock(&teedev->mutex); } if (shm->pages) { - for (n = 0; n < shm->num_pages; n++) - put_page(shm->pages[n]); + put_user_pages(shm->pages, shm->num_pages); kfree(shm->pages); } }

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Bartlomiej Zolnierkiewicz b.zolnierkie@samsung.com Cc: Kees Cook keescook@chromium.org Cc: Al Viro viro@zeniv.linux.org.uk Cc: Bhumika Goyal bhumirks@gmail.com Cc: Arvind Yadav arvind.yadav.cs@gmail.com Cc: dri-devel@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/video/fbdev/pvr2fb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c index 7ff4b6b84282..0e4f9aa6444d 100644 --- a/drivers/video/fbdev/pvr2fb.c +++ b/drivers/video/fbdev/pvr2fb.c @@ -700,8 +700,7 @@ static ssize_t pvr2fb_write(struct fb_info *info, const char *buf, ret = count;

out_unmap: - for (i = 0; i < nr_pages; i++) - put_page(pages[i]); + put_user_pages(pages, nr_pages);

kfree(pages);

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

This changes the release code slightly, because each page slot in the page_list[] array is no longer checked for NULL. However, that check was wrong anyway, because the get_user_pages() pattern of usage here never allowed for NULL entries within a range of pinned pages.

Cc: Al Viro viro@zeniv.linux.org.uk Cc: Kees Cook keescook@chromium.org Cc: Rob Herring robh@kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- drivers/virt/fsl_hypervisor.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c index 93d5bebf9572..a8f78d572c45 100644 --- a/drivers/virt/fsl_hypervisor.c +++ b/drivers/virt/fsl_hypervisor.c @@ -292,11 +292,8 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) virt_to_phys(sg_list), num_pages);

exit: - if (pages) { - for (i = 0; i < num_pages; i++) - if (pages[i]) - put_page(pages[i]); - } + if (pages) + put_user_pages(pages, num_pages);

kfree(sg_list_unaligned); kfree(pages);

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Alexander Viro viro@zeniv.linux.org.uk Cc: linux-fsdevel@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/exec.c b/fs/exec.c index f7f6a140856a..ee442151582f 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -227,7 +227,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,

static void put_arg_page(struct page *page) { - put_page(page); + put_user_page(page); }

static void free_arg_pages(struct linux_binprm *bprm)

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Peter Zijlstra peterz@infradead.org Cc: Ingo Molnar mingo@redhat.com Cc: Arnaldo Carvalho de Melo acme@kernel.org Cc: Alexander Shishkin alexander.shishkin@linux.intel.com Cc: Jiri Olsa jolsa@redhat.com Cc: Namhyung Kim namhyung@kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- kernel/events/uprobes.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index 84fa00497c49..4a575de8cec8 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -397,7 +397,7 @@ __update_ref_ctr(struct mm_struct *mm, unsigned long vaddr, short d) ret = 0; out: kunmap_atomic(kaddr); - put_page(page); + put_user_page(page); return ret; }

@@ -504,7 +504,7 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, ret = __replace_page(vma, vaddr, old_page, new_page); put_page(new_page); put_old: - put_page(old_page); + put_user_page(old_page);

if (unlikely(ret == -EAGAIN)) goto retry; @@ -1981,7 +1981,7 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr) return result;

copy_from_page(page, vaddr, &opcode, UPROBE_SWBP_INSN_SIZE); - put_page(page); + put_user_page(page); out: /* This needs to return true for any variant of the trap insn */ return is_trap_insn(&opcode);

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Dan Williams dan.j.williams@intel.com Cc: Jan Kara jack@suse.cz Cc: Mel Gorman mgorman@suse.de Cc: Vlastimil Babka vbabka@suse.cz Signed-off-by: John Hubbard jhubbard@nvidia.com --- mm/frame_vector.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/mm/frame_vector.c b/mm/frame_vector.c index c64dca6e27c2..f590badac776 100644 --- a/mm/frame_vector.c +++ b/mm/frame_vector.c @@ -120,7 +120,6 @@ EXPORT_SYMBOL(get_vaddr_frames); */ void put_vaddr_frames(struct frame_vector *vec) { - int i; struct page **pages;

if (!vec->got_ref) @@ -133,8 +132,7 @@ void put_vaddr_frames(struct frame_vector *vec) */ if (WARN_ON(IS_ERR(pages))) goto out; - for (i = 0; i < vec->nr_frames; i++) - put_page(pages[i]); + put_user_pages(pages, vec->nr_frames); vec->got_ref = false; out: vec->nr_frames = 0;

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Aneesh Kumar K.V aneesh.kumar@linux.ibm.com Cc: Huang Ying ying.huang@intel.com Cc: Jérôme Glisse jglisse@redhat.com Cc: Matthew Wilcox willy@infradead.org Cc: Michal Hocko mhocko@suse.com Cc: Peter Zijlstra peterz@infradead.org Cc: Rik van Riel riel@surriel.com Cc: Souptick Joarder jrdr.linux@gmail.com Cc: Will Deacon will.deacon@arm.com Signed-off-by: John Hubbard jhubbard@nvidia.com --- mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memory.c b/mm/memory.c index e2bb51b6242e..8870968496ea 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -4337,7 +4337,7 @@ int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, buf, maddr + offset, bytes); } kunmap(page); - put_page(page); + put_user_page(page); } len -= bytes; buf += bytes;

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Al Viro viro@zeniv.linux.org.uk Cc: Andrea Arcangeli aarcange@redhat.com Cc: Christopher Yeoh cyeoh@au1.ibm.com Cc: Dave Hansen dave.hansen@linux.intel.com Cc: Heiko Carstens heiko.carstens@de.ibm.com Cc: Ingo Molnar mingo@kernel.org Cc: Jann Horn jann@thejh.net Cc: Lorenzo Stoakes lstoakes@gmail.com Cc: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Mike Rapoport rppt@linux.vnet.ibm.com Cc: Rashika Kheria rashika.kheria@gmail.com Signed-off-by: John Hubbard jhubbard@nvidia.com --- mm/process_vm_access.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c index 357aa7bef6c0..4d29d54ec93f 100644 --- a/mm/process_vm_access.c +++ b/mm/process_vm_access.c @@ -96,7 +96,7 @@ static int process_vm_rw_single_vec(unsigned long addr, flags |= FOLL_WRITE;

while (!rc && nr_pages && iov_iter_count(iter)) { - int pages = min(nr_pages, max_pages_per_loop); + int pinned_pages = min(nr_pages, max_pages_per_loop); int locked = 1; size_t bytes;

@@ -106,14 +106,15 @@ static int process_vm_rw_single_vec(unsigned long addr, * current/current->mm */ down_read(&mm->mmap_sem); - pages = get_user_pages_remote(task, mm, pa, pages, flags, - process_pages, NULL, &locked); + pinned_pages = get_user_pages_remote(task, mm, pa, pinned_pages, + flags, process_pages, NULL, + &locked); if (locked) up_read(&mm->mmap_sem); - if (pages <= 0) + if (pinned_pages <= 0) return -EFAULT;

- bytes = pages * PAGE_SIZE - start_offset; + bytes = pinned_pages * PAGE_SIZE - start_offset; if (bytes > len) bytes = len;

@@ -122,10 +123,9 @@ static int process_vm_rw_single_vec(unsigned long addr, vm_write); len -= bytes; start_offset = 0; - nr_pages -= pages; - pa += pages * PAGE_SIZE; - while (pages) - put_page(process_pages[--pages]); + nr_pages -= pinned_pages; + pa += pinned_pages * PAGE_SIZE; + put_user_pages(process_pages, pinned_pages); }

return rc;

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Reviewed-by: Calum Mackay calum.mackay@oracle.com

Cc: Trond Myklebust trond.myklebust@hammerspace.com Cc: Anna Schumaker anna.schumaker@netapp.com Cc: linux-nfs@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- fs/nfs/direct.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 0cb442406168..c0c1b9f2c069 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -276,13 +276,6 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) return nfs_file_direct_write(iocb, iter); }

-static void nfs_direct_release_pages(struct page **pages, unsigned int npages) -{ - unsigned int i; - for (i = 0; i < npages; i++) - put_page(pages[i]); -} - void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo, struct nfs_direct_req *dreq) { @@ -512,7 +505,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, pos += req_len; dreq->bytes_left -= req_len; } - nfs_direct_release_pages(pagevec, npages); + put_user_pages(pagevec, npages); kvfree(pagevec); if (result < 0) break; @@ -935,7 +928,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, pos += req_len; dreq->bytes_left -= req_len; } - nfs_direct_release_pages(pagevec, npages); + put_user_pages(pagevec, npages); kvfree(pagevec); if (result < 0) break;

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Peter Zijlstra peterz@infradead.org Cc: Ingo Molnar mingo@redhat.com Cc: Arnaldo Carvalho de Melo acme@kernel.org Cc: Alexander Shishkin alexander.shishkin@linux.intel.com Cc: Jiri Olsa jolsa@redhat.com Cc: Namhyung Kim namhyung@kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c index 0463c1151bae..7be52bbbfe87 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6426,7 +6426,7 @@ static u64 perf_virt_to_phys(u64 virt) phys_addr = page_to_phys(p) + virt % PAGE_SIZE;

if (p) - put_page(p); + put_user_page(p); }

return phys_addr;

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Acked-by: Tetsuo Handa penguin-kernel@I-love.SAKURA.ne.jp

Cc: Kentaro Takeda takedakn@nttdata.co.jp Cc: linux-security-module@vger.kernel.org Signed-off-by: John Hubbard jhubbard@nvidia.com --- security/tomoyo/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/tomoyo/domain.c b/security/tomoyo/domain.c index 8526a0a74023..6887beecfb6e 100644 --- a/security/tomoyo/domain.c +++ b/security/tomoyo/domain.c @@ -931,7 +931,7 @@ bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, } /* Same with put_arg_page(page) in fs/exec.c */ #ifdef CONFIG_MMU - put_page(page); + put_user_page(page); #endif return true; }

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Dan Williams dan.j.williams@intel.com Cc: Daniel Black daniel@linux.ibm.com Cc: Jan Kara jack@suse.cz Cc: Jérôme Glisse jglisse@redhat.com Cc: Matthew Wilcox willy@infradead.org Cc: Mike Kravetz mike.kravetz@oracle.com Signed-off-by: John Hubbard jhubbard@nvidia.com --- mm/mlock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/mlock.c b/mm/mlock.c index a90099da4fb4..b980e6270e8a 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -345,7 +345,7 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone) get_page(page); /* for putback_lru_page() */ __munlock_isolated_page(page); unlock_page(page); - put_page(page); /* from follow_page_mask() */ + put_user_page(page); /* from follow_page_mask() */ } } } @@ -467,7 +467,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma, if (page && !IS_ERR(page)) { if (PageTransTail(page)) { VM_BUG_ON_PAGE(PageMlocked(page), page); - put_page(page); /* follow_page_mask() */ + put_user_page(page); /* follow_page_mask() */ } else if (PageTransHuge(page)) { lock_page(page); /* @@ -478,7 +478,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma, */ page_mask = munlock_vma_page(page); unlock_page(page); - put_page(page); /* follow_page_mask() */ + put_user_page(page); /* follow_page_mask() */ } else { /* * Non-huge pages are handled in batches via

From: John Hubbard jhubbard@nvidia.com

For pages that were retained via get_user_pages*(), release those pages via the new put_user_page*() routines, instead of via put_page() or release_pages().

This is part a tree-wide conversion, as described in commit fc1d8e7cca2d ("mm: introduce put_user_page*(), placeholder versions").

Cc: Dan Williams dan.j.williams@intel.com Cc: Daniel Black daniel@linux.ibm.com Cc: Jan Kara jack@suse.cz Cc: Jérôme Glisse jglisse@redhat.com Cc: Matthew Wilcox willy@infradead.org Cc: Mike Kravetz mike.kravetz@oracle.com Signed-off-by: John Hubbard jhubbard@nvidia.com --- mm/ksm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/mm/ksm.c b/mm/ksm.c index 3dc4346411e4..e10ee4d5fdd8 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -456,7 +456,7 @@ static inline bool ksm_test_exit(struct mm_struct *mm) * We use break_ksm to break COW on a ksm page: it's a stripped down * * if (get_user_pages(addr, 1, 1, 1, &page, NULL) == 1) - * put_page(page); + * put_user_page(page); * * but taking great care only to touch a ksm page, in a VM_MERGEABLE vma, * in case the application has unmapped and remapped mm,addr meanwhile. @@ -483,7 +483,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr) FAULT_FLAG_WRITE | FAULT_FLAG_REMOTE); else ret = VM_FAULT_WRITE; - put_page(page); + put_user_page(page); } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM))); /* * We must loop because handle_mm_fault() may back out if there's @@ -568,7 +568,7 @@ static struct page *get_mergeable_page(struct rmap_item *rmap_item) flush_anon_page(vma, page, addr); flush_dcache_page(page); } else { - put_page(page); + put_user_page(page); out: page = NULL; } @@ -1974,10 +1974,10 @@ struct rmap_item *unstable_tree_search_insert(struct rmap_item *rmap_item,

parent = *new; if (ret < 0) { - put_page(tree_page); + put_user_page(tree_page); new = &parent->rb_left; } else if (ret > 0) { - put_page(tree_page); + put_user_page(tree_page); new = &parent->rb_right; } else if (!ksm_merge_across_nodes && page_to_nid(tree_page) != nid) { @@ -1986,7 +1986,7 @@ struct rmap_item *unstable_tree_search_insert(struct rmap_item *rmap_item, * it will be flushed out and put in the right unstable * tree next time: only merge with it when across_nodes. */ - put_page(tree_page); + put_user_page(tree_page); return NULL; } else { *tree_pagep = tree_page; @@ -2328,7 +2328,7 @@ static struct rmap_item *scan_get_next_rmap_item(struct page **page) &rmap_item->rmap_list; ksm_scan.address += PAGE_SIZE; } else - put_page(*page); + put_user_page(*page); up_read(&mm->mmap_sem); return rmap_item; }