lkml.org 
[lkml]   [2004]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[BUG] hugetlb MAP_PRIVATE mapping vs /dev/zero
Hello.

Hugetlbfs mmap with MAP_PRIVATE becomes MAP_SHARED
silently, but vma->vm_flags have no VM_SHARED bit.
I think it make sense to forbid MAP_PRIVATE in
hugetlbfs_file_mmap() because it may confuse user
space applications. But the real bug is that reading
from /dev/zero into hugetlb will do:

read_zero()
read_zero_pagealigned()
if (vma->vm_flags & VM_SHARED)
break; // OK if MAP_PRIVATE
zap_page_range();
zeromap_page_range();

We can fix hugetlbfs_file_mmap() or read_zero_pagealigned()
or both.

Oleg.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>

diff -urp 2.6.7-clean/drivers/char/mem.c 2.6.7-mmap/drivers/char/mem.c
--- 2.6.7-clean/drivers/char/mem.c 2004-05-30 13:25:49.000000000 +0400
+++ 2.6.7-mmap/drivers/char/mem.c 2004-07-01 19:51:52.000000000 +0400
@@ -417,7 +417,7 @@ static inline size_t read_zero_pagealign

if (vma->vm_start > addr || (vma->vm_flags & VM_WRITE) == 0)
goto out_up;
- if (vma->vm_flags & VM_SHARED)
+ if (vma->vm_flags & (VM_SHARED | VM_HUGETLB))
break;
count = vma->vm_end - addr;
if (count > size)
diff -urp 2.6.7-clean/fs/hugetlbfs/inode.c 2.6.7-mmap/fs/hugetlbfs/inode.c
--- 2.6.7-clean/fs/hugetlbfs/inode.c 2004-05-24 14:16:11.000000000 +0400
+++ 2.6.7-mmap/fs/hugetlbfs/inode.c 2004-07-01 19:54:16.000000000 +0400
@@ -28,6 +28,7 @@
#include <linux/security.h>

#include <asm/uaccess.h>
+#include <asm/mman.h>

/* some random number */
#define HUGETLBFS_MAGIC 0x958458f6
@@ -52,6 +53,9 @@ static int hugetlbfs_file_mmap(struct fi
loff_t len, vma_len;
int ret;

+ if (!(vma->vm_flags & VM_MAYSHARE))
+ return -EINVAL;
+
if (vma->vm_start & ~HPAGE_MASK)
return -EINVAL;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-03-22 14:04    [W:0.107 / U:1.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site