diff options
| author | Joao Martins <[email protected]> | 2021-07-14 21:27:11 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2021-07-15 10:13:49 -0700 |
| commit | d08af0a59684e18a51aa4bfd24c658994ea3fc5b (patch) | |
| tree | 20183f284e5c2d7f150ed5d359699491ad221af4 | |
| parent | b3b2177a2d795e35dc11597b2609eb1e7e57e570 (diff) | |
mm/hugetlb: fix refs calculation from unaligned @vaddr
Commit 82e5d378b0e47 ("mm/hugetlb: refactor subpage recording")
refactored the count of subpages but missed an edge case when @vaddr is
not aligned to PAGE_SIZE e.g. when close to vma->vm_end. It would then
errousnly set @refs to 0 and record_subpages_vmas() wouldn't set the
@pages array element to its value, consequently causing the reported
null-deref by syzbot.
Fix it by aligning down @vaddr by PAGE_SIZE in @refs calculation.
Link: https://lkml.kernel.org/r/[email protected]
Fixes: 82e5d378b0e47 ("mm/hugetlb: refactor subpage recording")
Reported-by: [email protected]
Signed-off-by: Joao Martins <[email protected]>
Reviewed-by: Mike Kravetz <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
| -rw-r--r-- | mm/hugetlb.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 924553aa8f78..dfc940d5221d 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5440,8 +5440,9 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma, continue; } - refs = min3(pages_per_huge_page(h) - pfn_offset, - (vma->vm_end - vaddr) >> PAGE_SHIFT, remainder); + /* vaddr may not be aligned to PAGE_SIZE */ + refs = min3(pages_per_huge_page(h) - pfn_offset, remainder, + (vma->vm_end - ALIGN_DOWN(vaddr, PAGE_SIZE)) >> PAGE_SHIFT); if (pages || vmas) record_subpages_vmas(mem_map_offset(page, pfn_offset), |