Linus Torvalds 28f068a17b mm: prevent get_user_pages() from overflowing page refcount ... commit 8fde12ca79aff9b5ba951fce1a2641901b8d8e64 upstream. If the page refcount wraps around past zero, it will be freed while there are still four billion references to it. One of the possible avenues for an attacker to try to make this happen is by doing direct IO on a page multiple times. This patch makes get_user_pages() refuse to take a new page reference if there are already more than two billion references to the page. Reported-by: Jann Horn <jannh@google.com> Acked-by: Matthew Wilcox <willy@infradead.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [ 4.4.y backport notes: Ajay: - Added local variable 'err' with-in follow_hugetlb_page() from 2be7cfed995e, to resolve compilation error - Added page_ref_count() - Added missing refcount overflow checks on x86 and s390 (Vlastimil, thanks for this change) Srivatsa: - Replaced call to get_page_foll() with try_get_page_foll() ] Signed-off-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu> Signed-off-by: Ajay Kaher <akaher@vmware.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-04-07 14:08:50 +02:00
..
appldata
boot
configs
crypto
hypfs	hypfs: Fix error number left in struct pointer member	2020-04-07 07:55:11 +02:00
include	s390/time: Fix clk type in get_tod_clock	2020-04-07 13:55:19 +02:00
kernel	s390/ftrace: generate traced function stack frame	2020-04-07 13:57:03 +02:00
kvm	KVM: s390: unregister debug feature on failing arch init	2020-04-07 12:41:46 +02:00
lib
mm	mm: prevent get_user_pages() from overflowing page refcount	2020-04-07 14:08:50 +02:00
net	s390/bpf: use 32-bit index for tail calls	2020-04-06 21:36:20 +02:00
numa
oprofile
pci
defconfig
Kbuild
Kconfig
Kconfig.debug
Makefile