[Devel] [PATCH hci-8.1 4/8] oracle/mm: write protect preserved PTEs but keep them exclusive

[Konstantin Khorenko]

Commit 37d9f55655ea ("oracle/mm: do not write protect COW mappings when
preserving across exec") leaves the PTE of a preserved anonymous page
writable in both the outgoing and the new mm. With
CONFIG_PAGE_TABLE_CHECK, which refuses to install a writable PTE for an
anonymous page that is mapped already, the first preserving exec panics:

  kernel BUG at mm/page_table_check.c:118!
  RIP: 0010:page_table_check_set+0x484/0x520
   __page_table_check_ptes_set
   copy_present_ptes
   copy_pte_range
   ...
   copy_page_range_mt
   vma_dup
   exec_mmap

The writable PTE is not what prevents the COW of a pinned page: the
same patch keeps PageAnonExclusive set on the preserved page, and
do_wp_page() reuses an exclusive anonymous page instead of copying it.
Write protect the PTE in both mms again, as fork does. The first write
in the new image takes a fault that reuses the page, which is what the
PMD path already does since copy_huge_pmd() write protects both PMDs.
Unlike fork, the copy does not flush the TLB of the old mm after write
protecting it; the zap of the old ranges later in this series does.

Fixes: 37d9f55655ea ("oracle/mm: do not write protect COW mappings when preserving across exec")
https://virtuozzo.atlassian.net/browse/VSTOR-150231

Feature: oracle/mm: MADV_DOEXEC madvise() flag
Assisted-by: LLM
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 mm/memory.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index a240246762751..1c128162f5cda 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -956,15 +956,13 @@ static __always_inline void __copy_present_ptes(struct vm_area_struct *dst_vma,
 		pte_t pte, unsigned long addr, int nr)
 {
 	struct mm_struct *src_mm = src_vma->vm_mm;
-	bool is_exec_keep = !!(dst_vma->vm_flags & VM_EXEC_KEEP);
 
-	/* If it's a COW mapping, write protect it both processes. */
 	/*
-	 * But don't protect it if PTEs are being copied as part of preserving
-	 * memory across exec since the page may be pinned for DMA and must not
-	 * be COW'd.
+	 * If it's a COW mapping, write protect it both processes. A page
+	 * preserved across exec keeps PageAnonExclusive, so the new process
+	 * reuses it on the first write instead of copying it.
 	 */
-	if (is_cow_mapping(src_vma->vm_flags) && pte_write(pte) && !is_exec_keep) {
+	if (is_cow_mapping(src_vma->vm_flags) && pte_write(pte)) {
 		wrprotect_ptes(src_mm, addr, src_pte, nr);
 		pte = pte_wrprotect(pte);
 	}

-- 
2.43.0