Commit fdd1ec13 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds

[PATCH] hugetlbfs vm_pgoff bugs

1. hugetlbfs_file_mmap() must check that vm_pgoff is hugepage aligned.

2. hugetlb_vmtruncate_list() confuses << with >> while converting
   vm_pgoff to huge page offset, and zaps wrong area.
Signed-off-by: default avatarOleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 5fcadd1e
......@@ -52,6 +52,9 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
loff_t len, vma_len;
int ret;
if (vma->vm_pgoff & (HPAGE_SIZE / PAGE_SIZE - 1))
return -EINVAL;
if (vma->vm_start & ~HPAGE_MASK)
return -EINVAL;
......@@ -278,16 +281,16 @@ hugetlb_vmtruncate_list(struct prio_tree_root *root, unsigned long h_pgoff)
unsigned long v_length;
unsigned long v_offset;
h_vm_pgoff = vma->vm_pgoff << (HPAGE_SHIFT - PAGE_SHIFT);
v_length = vma->vm_end - vma->vm_start;
h_vm_pgoff = vma->vm_pgoff >> (HPAGE_SHIFT - PAGE_SHIFT);
v_offset = (h_pgoff - h_vm_pgoff) << HPAGE_SHIFT;
/*
* Is this VMA fully outside the truncation point?
*/
if (h_vm_pgoff >= h_pgoff)
v_offset = 0;
v_length = vma->vm_end - vma->vm_start;
zap_hugepage_range(vma,
vma->vm_start + v_offset,
v_length - v_offset);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment