Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933104Ab0G3SAq (ORCPT ); Fri, 30 Jul 2010 14:00:46 -0400 Received: from smtp-out.google.com ([216.239.44.51]:54335 "EHLO smtp-out.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932906Ab0G3R6k (ORCPT ); Fri, 30 Jul 2010 13:58:40 -0400 DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=date:from:x-x-sender:to:cc:subject:in-reply-to:message-id: references:user-agent:mime-version:content-type:x-system-of-record; b=bXqN5pgD2RvFe0vytZavxaQtJOQZXybJUWmHMNUw9mFhuDA762kS3aCrkHtLdOVXh dsyLGdRmNpWfcaCT71WLQ== Date: Fri, 30 Jul 2010 10:58:26 -0700 (PDT) From: Hugh Dickins X-X-Sender: hughd@tigran.mtv.corp.google.com To: Linus Torvalds cc: dann frazier , dann frazier , Andreas Barth , Andrew Morton , KAMEZAWA Hiroyuki , linux-ia64@vger.kernel.org, linux-kernel@vger.kernel.org, Rik van Riel , KOSAKI Motohiro , Nick Piggin , Mel Gorman , Minchan Kim , Ralf Baechle Subject: [PATCH] mm: fix ia64 crash when gcore reads gate area In-Reply-To: Message-ID: References: <20100720173512.GF26783@ldl.fc.hp.com> <20100721105136.9d4440de.kamezawa.hiroyu@jp.fujitsu.com> <20100721030629.GA9987@lackof.org> <20100727071914.GB22945@lackof.org> <20100727180330.b6ecba7f.kamezawa.hiroyu@jp.fujitsu.com> <20100727144326.GC22945@lackof.org> <20100729192216.GF20265@lackof.org> <20100730043423.GH20265@lackof.org> User-Agent: Alpine 1.00 (DEB 882 2007-12-20) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-System-Of-Record: true Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2187 Lines: 59 Debian's ia64 autobuilders have been seeing kernel freeze or reboot when running the gdb testsuite (Debian bug 588574): dannf bisected to 2.6.32 62eede62dafb4a6633eae7ffbeb34c60dba5e7b1 "mm: ZERO_PAGE without PTE_SPECIAL"; and reproduced it with gdb's gcore on a simple target. I'd missed updating the gate_vma handling in __get_user_pages(): that happens to use vm_normal_page() (nowadays failing on the zero page), yet reported success even when it failed to get a page - boom when access_process_vm() tried to copy that to its intermediate buffer. Fix this, resisting cleanups: in particular, leave it for now reporting success when not asked to get any pages - very probably safe to change, but let's not risk it without testing exposure. Why did ia64 crash with 16kB pages, but succeed with 64kB pages? Because setup_gate() pads each 64kB of its gate area with zero pages. Reported-by: Andreas Barth Bisected-by: dann frazier Signed-off-by: Hugh Dickins Tested-by: dann frazier Cc: stable@kernel.org --- Please add into 2.6.32-stable, 2.6.33-stable, 2.6.34-stable. mm/memory.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) --- 2.6.35-rc6/mm/memory.c 2010-05-30 17:58:57.000000000 -0700 +++ linux/mm/memory.c 2010-07-29 17:57:29.000000000 -0700 @@ -1394,10 +1394,20 @@ int __get_user_pages(struct task_struct return i ? : -EFAULT; } if (pages) { - struct page *page = vm_normal_page(gate_vma, start, *pte); + struct page *page; + + page = vm_normal_page(gate_vma, start, *pte); + if (!page) { + if (!(gup_flags & FOLL_DUMP) && + is_zero_pfn(pte_pfn(*pte))) + page = pte_page(*pte); + else { + pte_unmap(pte); + return i ? : -EFAULT; + } + } pages[i] = page; - if (page) - get_page(page); + get_page(page); } pte_unmap(pte); if (vmas) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/