linux-kernel - [PATCH 2/2] mm/huge_memory: cap max length on debugfs file entry folio split

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240424225449.1498244-3-mcgrof@kernel.org>
Date: Wed, 24 Apr 2024 15:54:49 -0700
From: Luis Chamberlain <mcgrof@...nel.org>
To: akpm@...ux-foundation.org,
	ziy@...dia.com,
	linux-mm@...ck.org
Cc: fstests@...r.kernel.org,
	linux-xfs@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	willy@...radead.org,
	hare@...e.de,
	john.g.garry@...cle.com,
	p.raghav@...sung.com,
	da.gomez@...sung.com,
	mcgrof@...nel.org
Subject: [PATCH 2/2] mm/huge_memory: cap max length on debugfs file entry folio split

Don't allow to query beyond a mapped file's length. Since this is just
a debugfs interface allow userspace to be lazy and use a large value so
we can just use the entire file.

Without this we can end up wasting cycles looking for folios which
just don't exist for no good reason.

Signed-off-by: Luis Chamberlain <mcgrof@...nel.org>
---
 mm/huge_memory.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 8386d24a163e..86a8c7b3b8dc 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3535,7 +3535,7 @@ static int split_huge_pages_in_file(const char *file_path, pgoff_t off_start,
 	struct file *candidate;
 	struct address_space *mapping;
 	int ret = -EINVAL;
-	pgoff_t index;
+	pgoff_t index, fsize;
 	int nr_pages = 1;
 	unsigned long total = 0, split = 0;
 
@@ -3547,11 +3547,14 @@ static int split_huge_pages_in_file(const char *file_path, pgoff_t off_start,
 	if (IS_ERR(candidate))
 		goto out;
 
+	mapping = candidate->f_mapping;
+	fsize = i_size_read(mapping->host);
+	if (off_end > fsize)
+		off_end = fsize;
+
 	pr_debug("split file-backed THPs in file: %s, page offset: [0x%lx - 0x%lx]\n",
 		 file_path, off_start, off_end);
 
-	mapping = candidate->f_mapping;
-
 	for (index = off_start; index < off_end; index += nr_pages) {
 		struct folio *folio = filemap_get_folio(mapping, index);
 
-- 
2.43.0