summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSteve Sistare <steven.sistare@oracle.com>2024-09-03 16:25:21 +0200
committerAndrew Morton <akpm@linux-foundation.org>2024-09-26 23:01:43 +0200
commitce645b9fdc78ec5d28067286e92871ddae6817d5 (patch)
tree6138bc81e2ee99b0a471fcd9ba1c0e5e9ecab782
parentmm/gup: fix memfd_pin_folios hugetlb page allocation (diff)
downloadlinux-ce645b9fdc78ec5d28067286e92871ddae6817d5.tar.xz
linux-ce645b9fdc78ec5d28067286e92871ddae6817d5.zip
mm/gup: fix memfd_pin_folios alloc race panic
If memfd_pin_folios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfd_alloc_folio(memfd, start_idx); if (IS_ERR(folio)) { ret = PTR_ERR(folio); if (ret != -EEXIST) goto err; then on the next trip through the "while start_idx" loop we panic here: if (folio) { folio_put(folio); To fix, set the folio to NULL on error. Link: https://lkml.kernel.org/r/1725373521-451395-6-git-send-email-steven.sistare@oracle.com Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Cc: David Hildenbrand <david@redhat.com> Cc: Jason Gunthorpe <jgg@nvidia.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Peter Xu <peterx@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-rw-r--r--mm/gup.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/mm/gup.c b/mm/gup.c
index 3e7eac9a4f2b..8d9b560a0fec 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -3702,6 +3702,7 @@ long memfd_pin_folios(struct file *memfd, loff_t start, loff_t end,
ret = PTR_ERR(folio);
if (ret != -EEXIST)
goto err;
+ folio = NULL;
}
}
}