Skip to content

Commit 373c455

Browse files
thejhtorvalds
authored andcommitted
mm/pagewalk.c: report holes in hugetlb ranges
This matters at least for the mincore syscall, which will otherwise copy uninitialized memory from the page allocator to userspace. It is probably also a correctness error for /proc/$pid/pagemap, but I haven't tested that. Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has no effect because the caller already checks for that. This only reports holes in hugetlb ranges to callers who have specified a hugetlb_entry callback. This issue was found using an AFL-based fuzzer. v2: - don't crash on ->pte_hole==NULL (Andrew Morton) - add Cc stable (Andrew Morton) Fixes: 1e25a27 ("mincore: apply page table walker on do_mincore()") Signed-off-by: Jann Horn <jannh@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 5bbcc0f commit 373c455

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

Diff for: mm/pagewalk.c

+5-1
Original file line numberDiff line numberDiff line change
@@ -188,8 +188,12 @@ static int walk_hugetlb_range(unsigned long addr, unsigned long end,
188188
do {
189189
next = hugetlb_entry_end(h, addr, end);
190190
pte = huge_pte_offset(walk->mm, addr & hmask, sz);
191-
if (pte && walk->hugetlb_entry)
191+
192+
if (pte)
192193
err = walk->hugetlb_entry(pte, hmask, addr, next, walk);
194+
else if (walk->pte_hole)
195+
err = walk->pte_hole(addr, next, walk);
196+
193197
if (err)
194198
break;
195199
} while (addr = next, addr != end);

0 commit comments

Comments
 (0)