Messages in this thread Patch in this message | | | Date | Thu, 01 Jul 2004 20:29:18 +0400 | From | Oleg Nesterov <> | Subject | [BUG] hugetlb MAP_PRIVATE mapping vs /dev/zero |
| |
Hello.
Hugetlbfs mmap with MAP_PRIVATE becomes MAP_SHARED silently, but vma->vm_flags have no VM_SHARED bit. I think it make sense to forbid MAP_PRIVATE in hugetlbfs_file_mmap() because it may confuse user space applications. But the real bug is that reading from /dev/zero into hugetlb will do:
read_zero() read_zero_pagealigned() if (vma->vm_flags & VM_SHARED) break; // OK if MAP_PRIVATE zap_page_range(); zeromap_page_range();
We can fix hugetlbfs_file_mmap() or read_zero_pagealigned() or both.
Oleg.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
diff -urp 2.6.7-clean/drivers/char/mem.c 2.6.7-mmap/drivers/char/mem.c --- 2.6.7-clean/drivers/char/mem.c 2004-05-30 13:25:49.000000000 +0400 +++ 2.6.7-mmap/drivers/char/mem.c 2004-07-01 19:51:52.000000000 +0400 @@ -417,7 +417,7 @@ static inline size_t read_zero_pagealign if (vma->vm_start > addr || (vma->vm_flags & VM_WRITE) == 0) goto out_up; - if (vma->vm_flags & VM_SHARED) + if (vma->vm_flags & (VM_SHARED | VM_HUGETLB)) break; count = vma->vm_end - addr; if (count > size) diff -urp 2.6.7-clean/fs/hugetlbfs/inode.c 2.6.7-mmap/fs/hugetlbfs/inode.c --- 2.6.7-clean/fs/hugetlbfs/inode.c 2004-05-24 14:16:11.000000000 +0400 +++ 2.6.7-mmap/fs/hugetlbfs/inode.c 2004-07-01 19:54:16.000000000 +0400 @@ -28,6 +28,7 @@ #include <linux/security.h> #include <asm/uaccess.h> +#include <asm/mman.h> /* some random number */ #define HUGETLBFS_MAGIC 0x958458f6 @@ -52,6 +53,9 @@ static int hugetlbfs_file_mmap(struct fi loff_t len, vma_len; int ret; + if (!(vma->vm_flags & VM_MAYSHARE)) + return -EINVAL; + if (vma->vm_start & ~HPAGE_MASK) return -EINVAL; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |