From 5026c0ae734ac488479af78ac0bc40e01c2bb190 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Fri, 26 Apr 2019 17:01:52 +0800 Subject: [PATCH] mm: make page ref count overflow check tighter and more explicit mainline inclusion from mainline-5.1-rc5 commit f958d7b528b1b40c44cfda5eabe2d82760d868c3 category: 13690 bugzilla: NA CVE: CVE-2019-11487 There are four commits to fix this CVE: fs: prevent page refcount overflow in pipe_buf_get mm: prevent get_user_pages() from overflowing page refcount mm: add 'try_get_page()' helper function mm: make page ref count overflow check tighter and more explicit ------------------------------------------------- We have a VM_BUG_ON() to check that the page reference count doesn't underflow (or get close to overflow) by checking the sign of the count. That's all fine, but we actually want to allow people to use a "get page ref unless it's already very high" helper function, and we want that one to use the sign of the page ref (without triggering this VM_BUG_ON). Change the VM_BUG_ON to only check for small underflows (or _very_ close to overflowing), and ignore overflows which have strayed into negative territory. Acked-by: Matthew Wilcox Cc: Jann Horn Cc: stable@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Yang Yingliang Reviewed-by: zhong jiang Signed-off-by: Yang Yingliang --- include/linux/mm.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 461a01c8e4b3..3c7c2dc17683 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -921,6 +921,10 @@ static inline bool is_device_public_page(const struct page *page) } #endif /* CONFIG_DEV_PAGEMAP_OPS */ +/* 127: arbitrary random number, small enough to assemble well */ +#define page_ref_zero_or_close_to_overflow(page) \ + ((unsigned int) page_ref_count(page) + 127u <= 127u) + static inline void get_page(struct page *page) { page = compound_head(page); @@ -928,7 +932,7 @@ static inline void get_page(struct page *page) * Getting a normal page or the head of a compound page * requires to already have an elevated page->_refcount. */ - VM_BUG_ON_PAGE(page_ref_count(page) <= 0, page); + VM_BUG_ON_PAGE(page_ref_zero_or_close_to_overflow(page), page); page_ref_inc(page); } -- GitLab