[Devel] [PATCH hci-8.1 2/7] oracle/mm: refuse MADV_DOEXEC on special mappings

[Konstantin Khorenko]

A DRM import of a dma-buf clears vm_ops before it calls the exporter's
mmap, and nothing on that path insists on MAP_SHARED. An exporter that
fills the VMA with remap_pfn_range() and sets no vm_ops of its own
leaves a VM_PFNMAP VMA that vma_is_anonymous() accepts. vma_dup() then
copies it with copy_page_range_mt(), which never calls
track_pfn_copy(), while vm_area_dup() hands the copy the VM_PAT of the
original: both mms free the same memtype reservation at teardown. For a
range outside RAM, the second free_pfn_range() either logs "freeing
invalid memtype" or removes the entry that another mapping of the same
range holds.

Preserving device or other special memory was never the intent of the
anonymous case. Refuse VM_SPECIAL there.

Fixes: d674aa9506ea ("oracle/mm: use padata for copying page ranges in vma_dup()")
https://virtuozzo.atlassian.net/browse/VSTOR-150232

Feature: oracle/mm: MADV_DOEXEC madvise() flag
Assisted-by: LLM
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 mm/madvise.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index b89d891e122c9..644057a2bbbb0 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -1310,10 +1310,11 @@ static int madvise_vma_behavior(struct vm_area_struct *vma,
 	case MADV_DOEXEC:
 		/*
 		 * MADV_DOEXEC is only supported on private, non-executable,
-		 * non-stack anonymous memory and if the VM_EXEC_KEEP flag
-		 * is available.
+		 * non-stack, non-special anonymous memory and if the
+		 * VM_EXEC_KEEP flag is available.
 		 */
-		if (!VM_EXEC_KEEP || !vma_is_anonymous(vma) || vma->vm_flags & (VM_EXEC|VM_SHARED|VM_STACK)) {
+		if (!VM_EXEC_KEEP || !vma_is_anonymous(vma) ||
+		    vma->vm_flags & (VM_EXEC | VM_SHARED | VM_STACK | VM_SPECIAL)) {
 			error = -EINVAL;
 			goto out;
 		}

-- 
2.43.0