[prev in list] [next in list] [prev in thread] [next in thread] 

List:       git-commits-head
Subject:    mm: fix ia64 crash when gcore reads gate area
From:       Linux Kernel Mailing List <linux-kernel () vger ! kernel ! org>
Date:       2010-07-31 2:59:02
Message-ID: 201007310259.o6V2x24F015116 () hera ! kernel ! org
[Download RAW message or body]

Gitweb:     http://git.kernel.org/linus/de51257aa301652876ab6e8f13ea4eadbe4a3846
Commit:     de51257aa301652876ab6e8f13ea4eadbe4a3846
Parent:     51c20fcced5badee0e2021c6c89f44aa3cbd72aa
Author:     Hugh Dickins <hughd@google.com>
AuthorDate: Fri Jul 30 10:58:26 2010 -0700
Committer:  Linus Torvalds <torvalds@linux-foundation.org>
CommitDate: Fri Jul 30 18:56:09 2010 -0700

    mm: fix ia64 crash when gcore reads gate area
    
    Debian's ia64 autobuilders have been seeing kernel freeze or reboot
    when running the gdb testsuite (Debian bug 588574): dannf bisected to
    2.6.32 62eede62dafb4a6633eae7ffbeb34c60dba5e7b1 "mm: ZERO_PAGE without
    PTE_SPECIAL"; and reproduced it with gdb's gcore on a simple target.
    
    I'd missed updating the gate_vma handling in __get_user_pages(): that
    happens to use vm_normal_page() (nowadays failing on the zero page),
    yet reported success even when it failed to get a page - boom when
    access_process_vm() tried to copy that to its intermediate buffer.
    
    Fix this, resisting cleanups: in particular, leave it for now reporting
    success when not asked to get any pages - very probably safe to change,
    but let's not risk it without testing exposure.
    
    Why did ia64 crash with 16kB pages, but succeed with 64kB pages?
    Because setup_gate() pads each 64kB of its gate area with zero pages.
    
    Reported-by: Andreas Barth <aba@not.so.argh.org>
    Bisected-by: dann frazier <dannf@debian.org>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Tested-by: dann frazier <dannf@dannf.org>
    Cc: stable@kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---
 mm/memory.c |   16 +++++++++++++---
 1 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 119b7cc..bde42c6 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1394,10 +1394,20 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 				return i ? : -EFAULT;
 			}
 			if (pages) {
-				struct page *page = vm_normal_page(gate_vma, start, *pte);
+				struct page *page;
+
+				page = vm_normal_page(gate_vma, start, *pte);
+				if (!page) {
+					if (!(gup_flags & FOLL_DUMP) &&
+					     is_zero_pfn(pte_pfn(*pte)))
+						page = pte_page(*pte);
+					else {
+						pte_unmap(pte);
+						return i ? : -EFAULT;
+					}
+				}
 				pages[i] = page;
-				if (page)
-					get_page(page);
+				get_page(page);
 			}
 			pte_unmap(pte);
 			if (vmas)
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]