Re: [RFC PATCH 1/3] mm: Don't pin ZERO_PAGE in pin_user_pages()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 25.05.23 17:51, David Howells wrote:
Make pin_user_pages*() leave the ZERO_PAGE unpinned if it extracts a
pointer to it from the page tables and make unpin_user_page*()
correspondingly ignore the ZERO_PAGE when unpinning.  We don't want to risk
overrunning the zero page's refcount as we're only allowed ~2 million pins
on it - something that userspace can conceivably trigger.


As Linus raised, the ZERO_PAGE(0) checks should probably be is_zero_pfn(page_to_pfn(page)).

Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
cc: Christoph Hellwig <hch@xxxxxxxxxxxxx>
cc: David Hildenbrand <david@xxxxxxxxxx>
cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
cc: Jens Axboe <axboe@xxxxxxxxx>
cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
cc: Jan Kara <jack@xxxxxxx>
cc: Jeff Layton <jlayton@xxxxxxxxxx>
cc: Jason Gunthorpe <jgg@xxxxxxxxxx>
cc: Logan Gunthorpe <logang@xxxxxxxxxxxx>
cc: Hillf Danton <hdanton@xxxxxxxx>
cc: Christian Brauner <brauner@xxxxxxxxxx>
cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
cc: linux-fsdevel@xxxxxxxxxxxxxxx
cc: linux-block@xxxxxxxxxxxxxxx
cc: linux-kernel@xxxxxxxxxxxxxxx
cc: linux-mm@xxxxxxxxx
---
  mm/gup.c | 25 ++++++++++++++++++++++++-
  1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/mm/gup.c b/mm/gup.c
index bbe416236593..d2662aa8cf01 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -51,7 +51,8 @@ static inline void sanity_check_pinned_pages(struct page **pages,
  		struct page *page = *pages;
  		struct folio *folio = page_folio(page);
- if (!folio_test_anon(folio))
+		if (page == ZERO_PAGE(0) ||
+		    !folio_test_anon(folio))
  			continue;
  		if (!folio_test_large(folio) || folio_test_hugetlb(folio))
  			VM_BUG_ON_PAGE(!PageAnonExclusive(&folio->page), page);
@@ -131,6 +132,13 @@ struct folio *try_grab_folio(struct page *page, int refs, unsigned int flags)
  	else if (flags & FOLL_PIN) {
  		struct folio *folio;
+ /*
+		 * Don't take a pin on the zero page - it's not going anywhere
+		 * and it is used in a *lot* of places.
+		 */
+		if (page == ZERO_PAGE(0))
+			return page_folio(ZERO_PAGE(0));

With the fixed check, this should be
	return page_folio(page);

I guess.

--
Thanks,

David / dhildenb




[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux