linux-kernel - [PATCH 1/4] hugetlbfs: clear resv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu,  5 Oct 2023 23:59:06 -0400
From:   riel@...riel.com
To:     linux-kernel@...r.kernel.org
Cc:     kernel-team@...a.com, linux-mm@...ck.org,
        akpm@...ux-foundation.org, muchun.song@...ux.dev,
        mike.kravetz@...cle.com, leit@...a.com, willy@...radead.org,
        Rik van Riel <riel@...riel.com>, stable@...nel.org
Subject: [PATCH 1/4] hugetlbfs: clear resv_map pointer if mmap fails

From: Rik van Riel <riel@...riel.com>

Hugetlbfs leaves a dangling pointer in the VMA if mmap fails.
This has not been a problem so far, but other code in this patch
series tries to follow that pointer.

Signed-off-by: Mike Kravetz <mike.kravetz@...cle.com>
Signed-off-by: Rik van Riel <riel@...riel.com>
Cc: stable@...nel.org
Fixes: 04ada095dcfc ("hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing")
---
 mm/hugetlb.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ba6d39b71cb1..a86e070d735b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1138,8 +1138,7 @@ static void set_vma_resv_map(struct vm_area_struct *vma, struct resv_map *map)
 	VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
 	VM_BUG_ON_VMA(vma->vm_flags & VM_MAYSHARE, vma);
 
-	set_vma_private_data(vma, (get_vma_private_data(vma) &
-				HPAGE_RESV_MASK) | (unsigned long)map);
+	set_vma_private_data(vma, (unsigned long)map);
 }
 
 static void set_vma_resv_flags(struct vm_area_struct *vma, unsigned long flags)
@@ -6806,8 +6805,10 @@ bool hugetlb_reserve_pages(struct inode *inode,
 		 */
 		if (chg >= 0 && add < 0)
 			region_abort(resv_map, from, to, regions_needed);
-	if (vma && is_vma_resv_set(vma, HPAGE_RESV_OWNER))
+	if (vma && is_vma_resv_set(vma, HPAGE_RESV_OWNER)) {
 		kref_put(&resv_map->refs, resv_map_release);
+		set_vma_resv_map(vma, NULL);
+	}
 	return false;
 }
 
-- 
2.41.0