Re: 2.3.7_andrea1.bz2

Bill Huey (billh@mag.ucsd.edu)
Tue, 22 Jun 1999 03:19:20 -0700 (PDT)


> static int create_page_buffers (int rw, struct page *page, kdev_t dev, int
> b[], int size, int bmap)
> {
> struct buffer_head *head, *bh, *tail;
> int block;
>
> if (!PageLocked(page))
> BUG();
> if (page->owner != (int)current)
> PAGE_BUG(page);
> ^^^^^^^^^^^^^^
>
> Andrea Arcangeli

Andrea,

I'm tempted to delete that assertion since it wasn't in 2.3.6.

Since current is #define'd as returning the current "task_struct",
I'm assuming that this is to prevent processes from creating pages
that it doesn't own.

The possible implication of this assertion failing is that there
is a security problem with page creation in the kernel.

"page->owner" is apparently debug code that plays with setting
the particular uid of the page.

It could also mean that the "struct page" isn't locked correctly.

I don't know.

The relevant files after "egrep -rn owners ." are:

./include/linux/mm.h:136: int owner; /* temporary debugging check */
./include/linux/mm.h:178: if (page->owner) PAGE_BUG(page); \
./include/linux/mm.h:179: page->owner = (int)current; } while (0)
./include/linux/mm.h:181: if (!_ret) page->owner = (int)current; _ret; })
./include/linux/mm.h:183: if (page->owner != (int)current) { \
./include/linux/mm.h:184:BUG(); } page->owner = 0; \
./mm/filemap.c:484: page->owner = (int)current; /* REMOVEME */
./mm/filemap.c:1961: if (page->owner != (int)current) {
./fs/nfs/read.c:154: page->owner = (int)current; // HACK, FIXME, will go away.
./fs/buffer.c:1271: if (page->owner != -1)
./fs/buffer.c:1273: page->owner = (int)current;
./fs/buffer.c:1290: if (page->owner != (int)current)
./fs/buffer.c:1654: page->owner = -1;
./fs/buffer.c:1695: page->owner = (int)current;
./fs/buffer.c:1727: page->owner = -1;
./fs/buffer.c:1781: page->owner = (int)current;

bill

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/