PWN-Hunter/android_kernel_xiaomi_sdm845
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[S390] pud_present/pmd_present bug.

Browse Source 
Git commit 3610cce87a (yeah my own :-/)
introduced a bug in regard to pud/pmd table entries.
If the address of the page table refered to by a pud/pmd value happens
to have zeroes in the lower 32 bits, pud_present and pmd_present return
false. The obvious effect is that this triggers the BUG_ON in exit_mmap
because some ptes will not get released on process end.  Worse is that
the next fault for memory covered by that pud/pmd will allocate another
pmd/pte table and populate the pud/pmd entry. The old page table
entries hanging below this entry are lost!

The fix is simple, properly check against 0. The check is added for
pud_none/pmd_none as well even if these two functions work because
the invalid bit is in the lower 32 bits.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Martin Schwidefsky 2007-12-17 16:25:48 +01:00
parent da8cadb31b
commit 0d01792300
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/asm-s390/pgtable.h
View File

@ -453,12 +453,12 @@ static inline int pgd_bad(pgd_t pgd) { return 0; }
static inline int pud_present(pud_t pud)
{
return pud_val(pud) & _REGION_ENTRY_ORIGIN;
return (pud_val(pud) & _REGION_ENTRY_ORIGIN) != 0UL;
}
static inline int pud_none(pud_t pud)
{
return pud_val(pud) & _REGION_ENTRY_INV;
return (pud_val(pud) & _REGION_ENTRY_INV) != 0UL;
}
static inline int pud_bad(pud_t pud)
@ -471,12 +471,12 @@ static inline int pud_bad(pud_t pud)
static inline int pmd_present(pmd_t pmd)
{
return pmd_val(pmd) & _SEGMENT_ENTRY_ORIGIN;
return (pmd_val(pmd) & _SEGMENT_ENTRY_ORIGIN) != 0UL;
}
static inline int pmd_none(pmd_t pmd)
{
return pmd_val(pmd) & _SEGMENT_ENTRY_INV;
return (pmd_val(pmd) & _SEGMENT_ENTRY_INV) != 0UL;
}
static inline int pmd_bad(pmd_t pmd)