• Linus Torvalds's avatar
    Merge branch 'page-refs' (page ref overflow) · 6b3a7077
    Linus Torvalds authored
    Merge page ref overflow branch.
    
    Jann Horn reported that he can overflow the page ref count with
    sufficient memory (and a filesystem that is intentionally extremely
    slow).
    
    Admittedly it's not exactly easy.  To have more than four billion
    references to a page requires a minimum of 32GB of kernel memory just
    for the pointers to the pages, much less any metadata to keep track of
    those pointers.  Jann needed a total of 140GB of memory and a specially
    crafted filesystem that leaves all reads pending (in order to not ever
    free the page references and just keep adding more).
    
    Still, we have a fairly straightforward way to limit the two obvious
    user-controllable sources of page references: direct-IO like page
    references gotten through get_user_pages(), and the splice pipe page
    duplication.  So let's just do that.
    
    * branch page-refs:
      fs: prevent page refcount overflow in pipe_buf_get
      mm: prevent get_user_pages() from overflowing page refcount
      mm: add 'try_get_page()' helper function
      mm: make page ref count overflow check tighter and more explicit
    6b3a7077
pipe.c 27.6 KB