Skip to content

Commit

Permalink
ARC: Incorrect mm reference used in vmalloc fault handler
Browse files Browse the repository at this point in the history
A vmalloc fault needs to sync up PGD/PTE entry from init_mm to current
task's "active_mm".  ARC vmalloc fault handler however was using mm.

A vmalloc fault for non user task context (actually pre-userland, from
init thread's open for /dev/console) caused the handler to deref NULL mm
(for mm->pgd)

The reasons it worked so far is amazing:

1. By default (!SMP), vmalloc fault handler uses a cached value of PGD.
   In SMP that MMU register is repurposed hence need for mm pointer deref.

2. In pre-3.12 SMP kernel, the problem triggering vmalloc didn't exist in
   pre-userland code path - it was introduced with commit 20bafb3
   "n_tty: Move buffers into n_tty_data"

Signed-off-by: Vineet Gupta <[email protected]>
Cc: Gilad Ben-Yossef <[email protected]>
Cc: Noam Camus <[email protected]>
Cc: [email protected]    #3.10 and 3.11
Cc: Peter Hurley <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
Vineet Gupta authored and torvalds committed Nov 2, 2013
1 parent 9581b7d commit 9c41f4e
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions arch/arc/mm/fault.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
#include <asm/pgalloc.h>
#include <asm/mmu.h>

static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address)
static int handle_vmalloc_fault(unsigned long address)
{
/*
* Synchronize this task's top level page-table
Expand All @@ -27,7 +27,7 @@ static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address)
pud_t *pud, *pud_k;
pmd_t *pmd, *pmd_k;

pgd = pgd_offset_fast(mm, address);
pgd = pgd_offset_fast(current->active_mm, address);
pgd_k = pgd_offset_k(address);

if (!pgd_present(*pgd_k))
Expand Down Expand Up @@ -72,7 +72,7 @@ void do_page_fault(struct pt_regs *regs, unsigned long address)
* nothing more.
*/
if (address >= VMALLOC_START && address <= VMALLOC_END) {
ret = handle_vmalloc_fault(mm, address);
ret = handle_vmalloc_fault(address);
if (unlikely(ret))
goto bad_area_nosemaphore;
else
Expand Down

0 comments on commit 9c41f4e

Please sign in to comment.