Patch "x86, mm: fix gup_pte_range() vs DAX mappings" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

x86, mm: fix gup_pte_range() vs DAX mappings

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-mm-fix-gup_pte_range-vs-dax-mappings.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Williams <[email protected]>
Date: Thu, 9 Mar 2017 16:16:42 -0800
Subject: x86, mm: fix gup_pte_range() vs DAX mappings

From: Dan Williams <[email protected]>

commit ef947b2529f918d9606533eb9c32b187ed6a5ede upstream.

gup_pte_range() fails to check pte_allows_gup() before translating a DAX pte entry, pte_devmap(), to a page. This allows writes to read-only mappings, and bypasses the DAX cacheline dirty tracking due to missed 'mkwrite' faults. The gup_huge_pmd() path and the gup_huge_pud() path correctly check pte_allows_gup() before checking for _devmap() entries.

---
 arch/x86/mm/gup.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -120,6 +120,11 @@ static noinline int gup_pte_range(pmd_t
 			return 0;
 		}
 
+		if (!pte_allows_gup(pte_val(pte), write)) {
+			pte_unmap(ptep);
+			return 0;
+		}
+
 		if (pte_devmap(pte)) {
 			pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
 			if (unlikely(!pgmap)) {

@@ -127,8 +132,7 @@ static noinline int gup_pte_range(pmd_t
 				pte_unmap(ptep);
 				return 0;
 			}
-		} else if (!pte_allows_gup(pte_val(pte), write) ||
-			   pte_special(pte)) {
+		} else if (pte_special(pte)) {
 			pte_unmap(ptep);
 			return 0;
 		}

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/nfit-libnvdimm-fix-interleave-set-cookie-calculation.patch queue-4.9/x86-mm-fix-gup_pte_range-vs-dax-mappings.patch