linux-kernel - Re: [PATCH] mm/huge_memory: Clean up typo when copying user highpage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111012155646.GC6478@redhat.com>
Date:	Wed, 12 Oct 2011 11:56:46 -0400
From:	Johannes Weiner <jweiner@...hat.com>
To:	Hillf Danton <dhillf@...il.com>
Cc:	Andrea Arcangeli <aarcange@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>, linux-mm@...ck.org,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] mm/huge_memory: Clean up typo when copying user highpage

On Wed, Oct 12, 2011 at 10:39:36PM +0800, Hillf Danton wrote:
> Hi Andrea
> 
> When copying user highpage, the PAGE_SHIFT in the third parameter is a typo,
> I think, and is replaced with PAGE_SIZE.

This is a pretty nasty data corruption bug, so 'clean up' might be a
bit of an understatement ;-)

Nice catch.

Would you mind extending the changelog to include a problem
description?  Feel free to steal from this:

	The THP copy-on-write handler falls back to regular-sized
	pages for a huge page replacement upon allocation failure or
	if THP has been individually disabled in the target VMA.  The
	loop responsible for copying page-sized chunks accidentally
	uses multiples of PAGE_SHIFT instead of PAGE_SIZE as the byte
	offset into the original huge page, though, and the
	COW-breaking task ends up with a corrupt copy of the data.

> Signed-off-by: Hillf Danton <dhillf@...il.com>

Acked-by: Johannes Weiner <jweiner@...hat.com>

> --- a/mm/huge_memory.c	Sat Aug 13 11:45:14 2011
> +++ b/mm/huge_memory.c	Wed Oct 12 22:26:15 2011
> @@ -829,7 +829,7 @@ static int do_huge_pmd_wp_page_fallback(
> 
>  	for (i = 0; i < HPAGE_PMD_NR; i++) {
>  		copy_user_highpage(pages[i], page + i,
> -				   haddr + PAGE_SHIFT*i, vma);
> +				   haddr + PAGE_SIZE * i, vma);
>  		__SetPageUptodate(pages[i]);
>  		cond_resched();
>  	}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/