shithub: riscv

Info  •  Files  •  Log  •  Branches

swap: track swap pages with > 255 references, setswapchan() swapimage.c

swaped pages use a 8bit refcount where as the Page uses a 16bit one.
this might be exploited with having a process having a single page
swaped out and then forking 255 times to make the swap map refcount
overflow and panic the kernel.

this condition is probably very rare. so instead of doubling the
size of the swap map, we add a single 32bit refcount swapalloc.xref
which will keep the combined refcount of all swap map entries who
exceeded 255 references.

zero swapimage.c in setswapchan() after closing it as the stat() call
below might error leaving a dangeling pointer.

--- a/sys/src/9/port/portdat.h

+++ b/sys/src/9/port/portdat.h

@@ -338,6 +338,7 @@

 	Rendez	r;			/* Pager kproc idle sleep */

 	ulong	highwater;		/* Pager start threshold */

 	ulong	headroom;		/* Space pager frees under highwater */

+	ulong	xref;			/* Ref count for all map refs >= 255 */

 }swapalloc;

 struct Image

--- a/sys/src/9/port/swap.c

+++ b/sys/src/9/port/swap.c

@@ -40,6 +40,8 @@

 	swapalloc.alloc = swapalloc.swmap;

 	swapalloc.last = swapalloc.swmap;

 	swapalloc.free = conf.nswap;

+	swapalloc.xref = 0;

+

 	iolist = xalloc(conf.nswppo*sizeof(Page*));

 	if(swapalloc.swmap == 0 || iolist == 0)

 		panic("swapinit: not enough memory");

@@ -53,8 +55,7 @@

 	uchar *look;

 	lock(&swapalloc);

-

-	if(swapalloc.free == 0){

+	if(swapalloc.free == 0) {

 		unlock(&swapalloc);

 		return ~0;

 	}

@@ -77,13 +78,30 @@

 	lock(&swapalloc);

 	idx = &swapalloc.swmap[((ulong)p)/BY2PG];

-	if(--(*idx) == 0) {

-		swapalloc.free++;

-		if(idx < swapalloc.last)

-			swapalloc.last = idx;

+	if(*idx == 0)

+		panic("putswap %#p ref == 0", p);

+

+	if(*idx == 255) {

+		if(swapalloc.xref == 0)

+			panic("putswap %#p xref == 0", p);

+

+		if(--swapalloc.xref == 0) {

+			for(idx = swapalloc.swmap; idx < swapalloc.top; idx++) {

+				if(*idx == 255) {

+					*idx = 0;

+					swapalloc.free++;

+					if(idx < swapalloc.last)

+						swapalloc.last = idx;

+				}

+			}

+		}

+	} else {

+		if(--(*idx) == 0) {

+			swapalloc.free++;

+			if(idx < swapalloc.last)

+				swapalloc.last = idx;

+		}

 	}

-	if(*idx >= 254)

-		panic("putswap %#p == %ud", p, *idx);

 	unlock(&swapalloc);

 }

@@ -90,9 +108,16 @@

 void

 dupswap(Page *p)

 {

+	uchar *idx;

+

 	lock(&swapalloc);

-	if(++swapalloc.swmap[((ulong)p)/BY2PG] == 0)

-		panic("dupswap");

+	idx = &swapalloc.swmap[((ulong)p)/BY2PG];

+	if(*idx == 255)

+		swapalloc.xref++;

+	else {

+		if(++(*idx) == 255)

+			swapalloc.xref += 255;

+	}

 	unlock(&swapalloc);

 }

@@ -413,6 +438,7 @@

 			error(Einuse);

 		}

 		cclose(swapimage.c);

+		swapimage.c = nil;

 	}

 	/*