mm/pagewalk.c: report holes in hugetlb ranges
authorJann Horn <jannh@google.com>
Tue, 14 Nov 2017 00:03:44 +0000 (01:03 +0100)
committerSasha Levin <alexander.levin@verizon.com>
Thu, 7 Dec 2017 02:20:16 +0000 (21:20 -0500)
commit610622cac573aef67811fbffc865d9fba1611050
tree477ffde95b2426348179355b4e0284765b78e652
parent66971c62fc2ed5cae67e46d3ec576339f55aed4b
mm/pagewalk.c: report holes in hugetlb ranges

[ Upstream commit 373c4557d2aa362702c4c2d41288fb1e54990b7c ]

This matters at least for the mincore syscall, which will otherwise copy
uninitialized memory from the page allocator to userspace.  It is
probably also a correctness error for /proc/$pid/pagemap, but I haven't
tested that.

Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has
no effect because the caller already checks for that.

This only reports holes in hugetlb ranges to callers who have specified
a hugetlb_entry callback.

This issue was found using an AFL-based fuzzer.

v2:
 - don't crash on ->pte_hole==NULL (Andrew Morton)
 - add Cc stable (Andrew Morton)

Fixes: 1e25a271c8ac ("mincore: apply page table walker on do_mincore()")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
mm/pagewalk.c