tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mm: fix ia64 crash when gcore reads gate area

Debian's ia64 autobuilders have been seeing kernel freeze or reboot
when running the gdb testsuite (Debian bug 588574): dannf bisected to
2.6.32 62eede62dafb4a6633eae7ffbeb34c60dba5e7b1 "mm: ZERO_PAGE without
PTE_SPECIAL"; and reproduced it with gdb's gcore on a simple target.

I'd missed updating the gate_vma handling in __get_user_pages(): that
happens to use vm_normal_page() (nowadays failing on the zero page),
yet reported success even when it failed to get a page - boom when
access_process_vm() tried to copy that to its intermediate buffer.

Fix this, resisting cleanups: in particular, leave it for now reporting
success when not asked to get any pages - very probably safe to change,
but let's not risk it without testing exposure.

Why did ia64 crash with 16kB pages, but succeed with 64kB pages?
Because setup_gate() pads each 64kB of its gate area with zero pages.

Reported-by: Andreas Barth <aba@not.so.argh.org>
Bisected-by: dann frazier <dannf@debian.org>
Signed-off-by: Hugh Dickins <hughd@google.com>
Tested-by: dann frazier <dannf@dannf.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Hugh Dickins and committed by
Linus Torvalds de51257a 51c20fcc

+13 -3
+13 -3
mm/memory.c
··· 1394 1394 return i ? : -EFAULT; 1395 1395 } 1396 1396 if (pages) { 1397 - struct page *page = vm_normal_page(gate_vma, start, *pte); 1397 + struct page *page; 1398 + 1399 + page = vm_normal_page(gate_vma, start, *pte); 1400 + if (!page) { 1401 + if (!(gup_flags & FOLL_DUMP) && 1402 + is_zero_pfn(pte_pfn(*pte))) 1403 + page = pte_page(*pte); 1404 + else { 1405 + pte_unmap(pte); 1406 + return i ? : -EFAULT; 1407 + } 1408 + } 1398 1409 pages[i] = page; 1399 - if (page) 1400 - get_page(page); 1410 + get_page(page); 1401 1411 } 1402 1412 pte_unmap(pte); 1403 1413 if (vmas)