提交 2e04865a 编写于 作者: Z ZhangPeng 提交者: Ma Wupeng

userswap: fix NULL pointer dereference in uswap_unmap_anon_page()

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6CAIM

--------------------------------

If old_pte is NULL, *old_pte will result in a null pointer dereference.
Fix this by adding a NULL check for old_pte.
Signed-off-by: NZhangPeng <zhangpeng362@huawei.com>
上级 cbf06b7d
...@@ -162,7 +162,7 @@ static void uswap_unmap_anon_page(struct mm_struct *mm, ...@@ -162,7 +162,7 @@ static void uswap_unmap_anon_page(struct mm_struct *mm,
{ {
struct mmu_notifier_range range; struct mmu_notifier_range range;
spinlock_t *ptl; spinlock_t *ptl;
pte_t *pte; pte_t *pte, _old_pte;
mmu_notifier_range_init(&range, MMU_NOTIFY_UNMAP, 0, vma, mmu_notifier_range_init(&range, MMU_NOTIFY_UNMAP, 0, vma,
vma->vm_mm, addr, addr + PAGE_SIZE); vma->vm_mm, addr, addr + PAGE_SIZE);
...@@ -171,7 +171,7 @@ static void uswap_unmap_anon_page(struct mm_struct *mm, ...@@ -171,7 +171,7 @@ static void uswap_unmap_anon_page(struct mm_struct *mm,
if (pte_none(*pte)) if (pte_none(*pte))
goto out_release_unlock; goto out_release_unlock;
flush_cache_page(vma, addr, pte_pfn(*pte)); flush_cache_page(vma, addr, pte_pfn(*pte));
*old_pte = ptep_clear_flush(vma, addr, pte); _old_pte = ptep_clear_flush(vma, addr, pte);
if (set_to_swp) if (set_to_swp)
set_pte_at(mm, addr, pte, swp_entry_to_pte(swp_entry( set_pte_at(mm, addr, pte, swp_entry_to_pte(swp_entry(
SWP_USERSWAP_ENTRY, page_to_pfn(page)))); SWP_USERSWAP_ENTRY, page_to_pfn(page))));
...@@ -184,6 +184,8 @@ static void uswap_unmap_anon_page(struct mm_struct *mm, ...@@ -184,6 +184,8 @@ static void uswap_unmap_anon_page(struct mm_struct *mm,
pte_unmap_unlock(pte, ptl); pte_unmap_unlock(pte, ptl);
mmu_notifier_invalidate_range_end(&range); mmu_notifier_invalidate_range_end(&range);
page->mapping = NULL; page->mapping = NULL;
if (old_pte)
*old_pte = _old_pte;
} }
static void uswap_map_anon_page(struct mm_struct *mm, static void uswap_map_anon_page(struct mm_struct *mm,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册