Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757619AbbKFTlK (ORCPT ); Fri, 6 Nov 2015 14:41:10 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:47930 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1033462AbbKFTco (ORCPT ); Fri, 6 Nov 2015 14:32:44 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Minchan Kim , Andrea Arcangeli , "Kirill A. Shutemov" , Mel Gorman , Vlastimil Babka , Hugh Dickins , Rik van Riel , Andrew Morton , Linus Torvalds Subject: [PATCH 4.1 81/86] thp: use is_zero_pfn() only after pte_present() check Date: Fri, 6 Nov 2015 11:23:20 -0800 Message-Id: <20151106192209.311753768@linuxfoundation.org> X-Mailer: git-send-email 2.6.2 In-Reply-To: <20151106192205.351595349@linuxfoundation.org> References: <20151106192205.351595349@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2014 Lines: 55 4.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Minchan Kim commit 47aee4d8e314384807e98b67ade07f6da476aa75 upstream. Use is_zero_pfn() on pteval only after pte_present() check on pteval (It might be better idea to introduce is_zero_pte() which checks pte_present() first). Otherwise when working on a swap or migration entry and if pte_pfn's result is equal to zero_pfn by chance, we lose user's data in __collapse_huge_page_copy(). So if you're unlucky, the application segfaults and finally you could see below message on exit: BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3 Fixes: ca0984caa823 ("mm: incorporate zero pages into transparent huge pages") Signed-off-by: Minchan Kim Reviewed-by: Andrea Arcangeli Acked-by: Kirill A. Shutemov Cc: Mel Gorman Acked-by: Vlastimil Babka Cc: Hugh Dickins Cc: Rik van Riel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/huge_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2137,7 +2137,8 @@ static int __collapse_huge_page_isolate( for (_pte = pte; _pte < pte+HPAGE_PMD_NR; _pte++, address += PAGE_SIZE) { pte_t pteval = *_pte; - if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) { + if (pte_none(pteval) || (pte_present(pteval) && + is_zero_pfn(pte_pfn(pteval)))) { if (++none_or_zero <= khugepaged_max_ptes_none) continue; else -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/