[PW_SID:976481] [v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap#583
[PW_SID:976481] [v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap#583linux-riscv-bot wants to merge 2 commits into
Conversation
… unmap As pointed out by David[1], the batched unmap logic in try_to_unmap_one() can read past the end of a PTE table if a large folio is mapped starting at the last entry of that table. It would be quite rare in practice, as MADV_FREE typically splits the large folio ;) So let's fix the potential out-of-bounds read by refactoring the logic into a new helper, folio_unmap_pte_batch(). The new helper now correctly calculates the safe number of pages to scan by limiting the operation to the boundaries of the current VMA and the PTE table. In addition, the "all-or-nothing" batching restriction is removed to support partial batches. The reference counting is also cleaned up to use folio_put_refs(). [1] https://lore.kernel.org/linux-mm/a694398c-9f03-4737-81b9-7e49c857fcbe@redhat.com Fixes: 354dffd ("mm: support batched unmap for lazyfree large folios during reclamation") Cc: <stable@vger.kernel.org> Suggested-by: David Hildenbrand <david@redhat.com> Suggested-by: Barry Song <baohua@kernel.org> Signed-off-by: Lance Yang <lance.yang@linux.dev> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
|
Patch 1: "[v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap" |
linux-riscv-bot
force-pushed
the
workflow__riscv__fixes
branch
from
b5ded79 to
a7cb30d
Compare
2 participants
PR for series 976481 applied to workflow__riscv__fixes
Name: [v2,1/1] mm/rmap: fix potential out-of-bounds page table access during batched unmap
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=976481
Version: 2