I built Xenial, Zesty and Artful test kernels with commit ba385c0594e723d. The test kernels can be downloaded from:
http://kernel.ubuntu.com/~jsalisbury/lp1730596/ Can you test these kernels to see if they resolve this bug? If they do, I'll submit an SRU request. ** Also affects: linux (Ubuntu Zesty) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Bionic) Importance: Critical Assignee: Skipper Bug Screeners (skipper-screen-team) Status: Triaged ** Also affects: linux (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Artful) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Xenial) Status: New => In Progress ** Changed in: linux (Ubuntu Zesty) Status: New => In Progress ** Changed in: linux (Ubuntu Artful) Status: New => In Progress ** Changed in: linux (Ubuntu Bionic) Status: Triaged => In Progress ** Changed in: linux (Ubuntu Xenial) Importance: Undecided => Critical ** Changed in: linux (Ubuntu Zesty) Importance: Undecided => Critical ** Changed in: linux (Ubuntu Artful) Importance: Undecided => Critical ** Changed in: linux (Ubuntu Bionic) Assignee: Skipper Bug Screeners (skipper-screen-team) => Joseph Salisbury (jsalisbury) ** Changed in: linux (Ubuntu Artful) Assignee: (unassigned) => Joseph Salisbury (jsalisbury) ** Changed in: linux (Ubuntu Zesty) Assignee: (unassigned) => Joseph Salisbury (jsalisbury) ** Changed in: linux (Ubuntu Xenial) Assignee: (unassigned) => Joseph Salisbury (jsalisbury) -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1730596 Title: s390/mm: fix write access check in gup_huge_pmd() Status in Ubuntu on IBM z Systems: Triaged Status in linux package in Ubuntu: In Progress Status in linux source package in Xenial: In Progress Status in linux source package in Zesty: In Progress Status in linux source package in Artful: In Progress Status in linux source package in Bionic: In Progress Bug description: The check for the _SEGMENT_ENTRY_PROTECT bit in gup_huge_pmd() is the wrong way around. It must not be set for write==1, and not be checked for write==0. Fix this similar to how it was fixed for ptes long time ago in commit 25591b0 ("[S390] fix get_user_pages_fast"). One impact of this bug would be unnecessarily using the gup slow path for write==0 on r/w mappings. A potentially more severe impact would be that gup_huge_pmd() will succeed for write==1 on r/o mappings. Addl information Problem: The check for the _SEGMENT_ENTRY_PROTECT bit in gup_huge_pmd() is the wrong way around. It must not be set for write==1, and not be checked for write==0. Allowing write==1 with protection bit set, instead of breaking out to the slow path, will result in a missing faultin_page() to clear the protection bit (for valid writable mappings), and the async I/O write operation will fail to write to such a mapping. Solution: Fix it by correctly checking the protection bit like it is also done in gup_pte_range() and gup_huge_pud(). Reproduction: Async I/O workload on buffers that are mapped as transparent hugepages. Upstream-ID: ba385c0594e723d41790ecfb12c610e6f90c7785 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/1730596/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
