Commit 8aca2bc9 authored by Kefeng Wang's avatar Kefeng Wang Committed by Andrew Morton
Browse files

mm: use aligned address in clear_gigantic_page() 

In current kernel, hugetlb_no_page() calls folio_zero_user() with the
fault address.  Where the fault address may be not aligned with the huge
page size.  Then, folio_zero_user() may call clear_gigantic_page() with
the address, while clear_gigantic_page() requires the address to be huge
page size aligned.  So, this may cause memory corruption or information
leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for
clear_gigantic_page().

Link: https://lkml.kernel.org/r/20241028145656.932941-1-wangkefeng.wang@huawei.com


Fixes: 78fefd04 ("mm: memory: convert clear_huge_page() to folio_zero_user()")
Signed-off-by: default avatarKefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: default avatar"Huang, Ying" <ying.huang@intel.com>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent dad2dc9c

fs/hugetlbfs/inode.c

+1 −1
Original line number Diff line number Diff line
@@ -825,7 +825,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset, 
			error = PTR_ERR(folio);

			goto out;

		}

		folio_zero_user(folio, ALIGN_DOWN(addr, hpage_size));

		folio_zero_user(folio, addr);

		__folio_mark_uptodate(folio);

		error = hugetlb_add_to_page_cache(folio, mapping, index);

		if (unlikely(error)) {

mm/memory.c

+2 −1
Original line number Diff line number Diff line
@@ -6815,9 +6815,10 @@ static inline int process_huge_page( 
	return 0;

}



static void clear_gigantic_page(struct folio *folio, unsigned long addr,

static void clear_gigantic_page(struct folio *folio, unsigned long addr_hint,

				unsigned int nr_pages)

{

	unsigned long addr = ALIGN_DOWN(addr_hint, folio_size(folio));

	int i;



	might_sleep();