Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHugh Dickins <hugh@veritas.com>2008-01-06 04:18:21 +0200
committerAdrian Bunk <bunk@kernel.org>2008-01-06 04:18:21 +0200
commitd808e724a4f4b8531c7fb8722e0e60100b3cb1c2 (patch)
tree3cf54b5207c2b51fe5080f5b25669550c7273560
parent86c4424d0a676b9d6dea8fb64e21c3d263aa88bb (diff)
tmpfs: restore missing clear_highpage (CVE-2007-6417)
tmpfs was misconverted to __GFP_ZERO in 2.6.11. There's an unusual case in which shmem_getpage receives the page from its caller instead of allocating. We must cover this case by clear_highpage before SetPageUptodate, as before. Signed-off-by: Hugh Dickins <hugh@veritas.com> Signed-off-by: Adrian Bunk <bunk@kernel.org>
-rw-r--r--mm/shmem.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/mm/shmem.c b/mm/shmem.c
index 9e71b6ca35eb..cde85ed53f18 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1040,7 +1040,7 @@ shmem_alloc_page(gfp_t gfp, struct shmem_inode_info *info,
pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, idx);
pvma.vm_pgoff = idx;
pvma.vm_end = PAGE_SIZE;
- page = alloc_page_vma(gfp | __GFP_ZERO, &pvma, 0);
+ page = alloc_page_vma(gfp, &pvma, 0);
mpol_free(pvma.vm_policy);
return page;
}
@@ -1060,7 +1060,7 @@ shmem_swapin(struct shmem_inode_info *info,swp_entry_t entry,unsigned long idx)
static inline struct page *
shmem_alloc_page(gfp_t gfp,struct shmem_inode_info *info, unsigned long idx)
{
- return alloc_page(gfp | __GFP_ZERO);
+ return alloc_page(gfp);
}
#endif
@@ -1277,6 +1277,7 @@ repeat:
info->alloced++;
spin_unlock(&info->lock);
+ clear_highpage(filepage);
flush_dcache_page(filepage);
SetPageUptodate(filepage);
}