On 28.10.24 15:56, Kefeng Wang wrote:
In current kernel, hugetlb_wp() calls copy_user_large_folio() with the
fault address. Where the fault address may be not aligned with the huge
page size. Then, copy_user_large_folio() may call copy_user_gigantic_page()
with the address, while copy_user_gigantic_page() requires the address
to be huge page size aligned. So, this may cause memory corruption or
information leak, addtional, use more obvious naming 'addr_hint' instead
of 'addr' for copy_user_gigantic_page().
Fixes: 530dd9926dc1 ("mm: memory: improve copy_user_large_folio()")
Signed-off-by: Kefeng Wang <wangkefeng.wang@xxxxxxxxxx>
---
Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>
--
Cheers,
David / dhildenb
