diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2019-04-15 00:09:40 +0200 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-04-15 00:09:40 +0200 |
commit | 6b3a707736301c2128ca85ce85fb13f60b5e350a (patch) | |
tree | 2bf1892cf29121150adece8d1221ecd513a4e792 /drivers/usb/host/uhci-grlib.c | |
parent | Merge tag 'for-linus-20190412' of git://git.kernel.dk/linux-block (diff) | |
parent | fs: prevent page refcount overflow in pipe_buf_get (diff) | |
download | linux-6b3a707736301c2128ca85ce85fb13f60b5e350a.tar.xz linux-6b3a707736301c2128ca85ce85fb13f60b5e350a.zip |
Merge branch 'page-refs' (page ref overflow)
Merge page ref overflow branch.
Jann Horn reported that he can overflow the page ref count with
sufficient memory (and a filesystem that is intentionally extremely
slow).
Admittedly it's not exactly easy. To have more than four billion
references to a page requires a minimum of 32GB of kernel memory just
for the pointers to the pages, much less any metadata to keep track of
those pointers. Jann needed a total of 140GB of memory and a specially
crafted filesystem that leaves all reads pending (in order to not ever
free the page references and just keep adding more).
Still, we have a fairly straightforward way to limit the two obvious
user-controllable sources of page references: direct-IO like page
references gotten through get_user_pages(), and the splice pipe page
duplication. So let's just do that.
* branch page-refs:
fs: prevent page refcount overflow in pipe_buf_get
mm: prevent get_user_pages() from overflowing page refcount
mm: add 'try_get_page()' helper function
mm: make page ref count overflow check tighter and more explicit
Diffstat (limited to 'drivers/usb/host/uhci-grlib.c')
0 files changed, 0 insertions, 0 deletions