Commit f446c631 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring/memmap: don't use page_address() on a highmem page 

For older/32-bit systems with highmem, don't assume that the pages in
a mapped region are always going to be mapped. If io_region_init_ptr()
finds that the pages are coalescable, also check if the first page is
a HighMem page or not. If it is, fall through to the usual vmap()
mapping rather than attempt to get the unmapped page address.

Cc: stable@vger.kernel.org
Fixes: c4d0ac1c ("io_uring/memmap: optimise single folio regions")
Link: https://lore.kernel.org/all/681fe2fb.050a0220.f2294.001a.GAE@google.com/


Reported-by: default avatar <syzbot+5b8c4abafcb1d791ccfc@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/all/681fed0a.050a0220.f2294.001c.GAE@google.com/


Reported-by: default avatar <syzbot+6456a99dfdc2e78c4feb@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+6456a99dfdc2e78c4feb@syzkaller.appspotmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 63166b81

io_uring/memmap.c

+1 −1
Original line number Diff line number Diff line
@@ -116,7 +116,7 @@ static int io_region_init_ptr(struct io_mapped_region *mr) 
	void *ptr;



	if (io_check_coalesce_buffer(mr->pages, mr->nr_pages, &ifd)) {

		if (ifd.nr_folios == 1) {

		if (ifd.nr_folios == 1 && !PageHighMem(mr->pages[0])) {

			mr->ptr = page_address(mr->pages[0]);

			return 0;

		}