diff options
| author | Hugh Dickins <hugh@veritas.com> | 2008-01-06 04:18:21 +0200 |
|---|---|---|
| committer | Adrian Bunk <bunk@kernel.org> | 2008-01-06 04:18:21 +0200 |
| commit | d808e724a4f4b8531c7fb8722e0e60100b3cb1c2 (patch) | |
| tree | 3cf54b5207c2b51fe5080f5b25669550c7273560 | |
| parent | 86c4424d0a676b9d6dea8fb64e21c3d263aa88bb (diff) | |
tmpfs: restore missing clear_highpage (CVE-2007-6417)
tmpfs was misconverted to __GFP_ZERO in 2.6.11. There's an unusual case in
which shmem_getpage receives the page from its caller instead of allocating.
We must cover this case by clear_highpage before SetPageUptodate, as before.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
| -rw-r--r-- | mm/shmem.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/mm/shmem.c b/mm/shmem.c index 9e71b6ca35e..cde85ed53f1 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1040,7 +1040,7 @@ shmem_alloc_page(gfp_t gfp, struct shmem_inode_info *info, pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, idx); pvma.vm_pgoff = idx; pvma.vm_end = PAGE_SIZE; - page = alloc_page_vma(gfp | __GFP_ZERO, &pvma, 0); + page = alloc_page_vma(gfp, &pvma, 0); mpol_free(pvma.vm_policy); return page; } @@ -1060,7 +1060,7 @@ shmem_swapin(struct shmem_inode_info *info,swp_entry_t entry,unsigned long idx) static inline struct page * shmem_alloc_page(gfp_t gfp,struct shmem_inode_info *info, unsigned long idx) { - return alloc_page(gfp | __GFP_ZERO); + return alloc_page(gfp); } #endif @@ -1277,6 +1277,7 @@ repeat: info->alloced++; spin_unlock(&info->lock); + clear_highpage(filepage); flush_dcache_page(filepage); SetPageUptodate(filepage); } |