mm: prevent get_user_pages() from overflowing page refcount

Browse source

If the page refcount wraps around past zero, it will be freed while
there are still four billion references to it.  One of the possible
avenues for an attacker to try to make this happen is by doing direct IO
on a page multiple times.  This patch makes get_user_pages() refuse to
take a new page reference if there are already more than two billion
references to the page.

Reported-by: Jann Horn <jannh@google.com>
Acked-by: Matthew Wilcox <willy@infradead.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

...

This commit is contained in:

Linus Torvalds 2019-04-11 10:49:19 -07:00

parent 88b1a17dfc

commit 8fde12ca79

2 changed files with 49 additions and 12 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

48

mm/gup.c

View file

13

mm/hugetlb.c

View file