Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S932411AbbB0U72 (ORCPT <rfc822;w@1wt.eu>);
	Fri, 27 Feb 2015 15:59:28 -0500
Received: from mail-ig0-f175.google.com ([209.85.213.175]:34006 "EHLO
	mail-ig0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1755315AbbB0U70 (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 27 Feb 2015 15:59:26 -0500
Date: Fri, 27 Feb 2015 12:59:22 -0800 (PST)
From: David Rientjes <rientjes@google.com>
X-X-Sender: rientjes@chino.kir.corp.google.com
To: Andrey Ryabinin <a.ryabinin@samsung.com>
cc: linux-kernel@vger.kernel.org, dvyukov@google.com, kcc@google.com,
        dmitryc@google.com, adech.fo@gmail.com, tetra2005@gmail.com,
        koct9i@gmail.com, sasha.levin@oracle.com, cl@linux.com,
        iamjoonsoo.kim@lge.com, dave.hansen@intel.com, andi@firstfloor.org,
        mingo@elte.hu, tglx@linutronix.de, hpa@zytor.com, penberg@kernel.org,
        gregkh@linuxfoundation.org, arve@android.com, riandrews@android.com,
        serban.constantinescu@arm.com, john.stultz@linaro.org,
        sumit.semwal@linaro.org, devel@driverdev.osuosl.org
Subject: Re: [PATCH v2] android: binder: fix binder mmap failures
In-Reply-To: <1425059061-5489-1-git-send-email-a.ryabinin@samsung.com>
Message-ID: <alpine.DEB.2.10.1502271259070.2122@chino.kir.corp.google.com>
References: <CAMi1Hd0frW_BqLwPQ7M_CKbA8-SeYhykwWYFZ-_iSre5r3zK7Q@mail.gmail.com> <1425059061-5489-1-git-send-email-a.ryabinin@samsung.com>
User-Agent: Alpine 2.10 (DEB 1266 2009-07-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 2727
Lines: 54

On Fri, 27 Feb 2015, Andrey Ryabinin wrote:

> binder_update_page_range() initializes only addr and size
> fields in 'struct vm_struct tmp_area;' and passes it to
> map_vm_area().
> 
> Before 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> this was because map_vm_area() didn't use any other fields
> in vm_struct except addr and size.
> 
> Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
> flags to determine whether vm area has guard hole or not.
> 
> binder_update_page_range() don't initialize flags field, so
> this causes following binder mmap failures:
> -----------[ cut here ]------------
> WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
> vmap_page_range_noflush+0x119/0x144()
> CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
> Hardware name: ARM-Versatile Express
> [<c001246d>] (unwind_backtrace) from [<c000f7f9>] (show_stack+0x11/0x14)
> [<c000f7f9>] (show_stack) from [<c049a221>] (dump_stack+0x59/0x7c)
> [<c049a221>] (dump_stack) from [<c001cf21>] (warn_slowpath_common+0x55/0x84)
> [<c001cf21>] (warn_slowpath_common) from [<c001cfe3>]
> (warn_slowpath_null+0x17/0x1c)
> [<c001cfe3>] (warn_slowpath_null) from [<c00c66c5>]
> (vmap_page_range_noflush+0x119/0x144)
> [<c00c66c5>] (vmap_page_range_noflush) from [<c00c716b>] (map_vm_area+0x27/0x48)
> [<c00c716b>] (map_vm_area) from [<c038ddaf>]
> (binder_update_page_range+0x12f/0x27c)
> [<c038ddaf>] (binder_update_page_range) from [<c038e857>]
> (binder_mmap+0xbf/0x1ac)
> [<c038e857>] (binder_mmap) from [<c00c2dc7>] (mmap_region+0x2eb/0x4d4)
> [<c00c2dc7>] (mmap_region) from [<c00c3197>] (do_mmap_pgoff+0x1e7/0x250)
> [<c00c3197>] (do_mmap_pgoff) from [<c00b35b5>] (vm_mmap_pgoff+0x45/0x60)
> [<c00b35b5>] (vm_mmap_pgoff) from [<c00c1f39>] (SyS_mmap_pgoff+0x5d/0x80)
> [<c00c1f39>] (SyS_mmap_pgoff) from [<c000ce81>] (ret_fast_syscall+0x1/0x5c)
> ---[ end trace 48c2c4b9a1349e54 ]---
> binder: 1982: binder_alloc_buf failed to map page at f0e00000 in kernel
> binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12
> 
> Use map_kernel_range_noflush() instead of map_vm_area() as this is better
> API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at all.
> 
> Fixes: 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
> Reported-by: Amit Pundir <amit.pundir@linaro.org>

Acked-by: David Rientjes <rientjes@google.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/