-
- Downloads
Merge branch 'page-refs' (page ref overflow)
Merge page ref overflow branch. Jann Horn reported that he can overflow the page ref count with sufficient memory (and a filesystem that is intentionally extremely slow). Admittedly it's not exactly easy. To have more than four billion references to a page requires a minimum of 32GB of kernel memory just for the pointers to the pages, much less any metadata to keep track of those pointers. Jann needed a total of 140GB of memory and a specially crafted filesystem that leaves all reads pending (in order to not ever free the page references and just keep adding more). Still, we have a fairly straightforward way to limit the two obvious user-controllable sources of page references: direct-IO like page references gotten through get_user_pages(), and the splice pipe page duplication. So let's just do that. * branch page-refs: fs: prevent page refcount overflow in pipe_buf_get mm: prevent get_user_pages() from overflowing page refcount mm: add 'try_get_page()' helper function mm: make page ref count overflow check tighter and more explicit
No related branches found
No related tags found
Showing
- fs/fuse/dev.c 6 additions, 6 deletionsfs/fuse/dev.c
- fs/pipe.c 2 additions, 2 deletionsfs/pipe.c
- fs/splice.c 10 additions, 2 deletionsfs/splice.c
- include/linux/mm.h 14 additions, 1 deletioninclude/linux/mm.h
- include/linux/pipe_fs_i.h 6 additions, 4 deletionsinclude/linux/pipe_fs_i.h
- kernel/trace/trace.c 5 additions, 1 deletionkernel/trace/trace.c
- mm/gup.c 36 additions, 12 deletionsmm/gup.c
- mm/hugetlb.c 13 additions, 0 deletionsmm/hugetlb.c
Loading
Please register or sign in to comment