diff options
| author | Jann Horn <jannh@google.com> | 2017-11-14 01:03:44 +0100 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2017-12-06 21:20:16 -0500 |
| commit | 610622cac573aef67811fbffc865d9fba1611050 (patch) | |
| tree | 477ffde95b2426348179355b4e0284765b78e652 | |
| parent | 66971c62fc2ed5cae67e46d3ec576339f55aed4b (diff) | |
mm/pagewalk.c: report holes in hugetlb ranges
[ Upstream commit 373c4557d2aa362702c4c2d41288fb1e54990b7c ]
This matters at least for the mincore syscall, which will otherwise copy
uninitialized memory from the page allocator to userspace. It is
probably also a correctness error for /proc/$pid/pagemap, but I haven't
tested that.
Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has
no effect because the caller already checks for that.
This only reports holes in hugetlb ranges to callers who have specified
a hugetlb_entry callback.
This issue was found using an AFL-based fuzzer.
v2:
- don't crash on ->pte_hole==NULL (Andrew Morton)
- add Cc stable (Andrew Morton)
Fixes: 1e25a271c8ac ("mincore: apply page table walker on do_mincore()")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
| -rw-r--r-- | mm/pagewalk.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/mm/pagewalk.c b/mm/pagewalk.c index 29f2f8b853ae..c2cbd2620169 100644 --- a/mm/pagewalk.c +++ b/mm/pagewalk.c @@ -142,8 +142,12 @@ static int walk_hugetlb_range(unsigned long addr, unsigned long end, do { next = hugetlb_entry_end(h, addr, end); pte = huge_pte_offset(walk->mm, addr & hmask); - if (pte && walk->hugetlb_entry) + + if (pte) err = walk->hugetlb_entry(pte, hmask, addr, next, walk); + else if (walk->pte_hole) + err = walk->pte_hole(addr, next, walk); + if (err) break; } while (addr = next, addr != end); |