diff options
| author | Vineet Gupta <Vineet.Gupta1@synopsys.com> | 2013-11-02 17:47:49 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-11-13 12:05:32 +0900 |
| commit | 40a894023d9a4c58379eb4f2ac12e40a2fe014d3 (patch) | |
| tree | 7f9c78ae30f6d32b41aa7a35dc3cf53633ae505c /arch | |
| parent | 27b840ea211f8a36fadabaa07ef94fb1b45730c3 (diff) | |
| download | linux-3.10-40a894023d9a4c58379eb4f2ac12e40a2fe014d3.tar.gz linux-3.10-40a894023d9a4c58379eb4f2ac12e40a2fe014d3.tar.bz2 linux-3.10-40a894023d9a4c58379eb4f2ac12e40a2fe014d3.zip | |
ARC: Incorrect mm reference used in vmalloc fault handler
commit 9c41f4eeb9d51f3ece20428d35a3ea32cf3b5622 upstream.
A vmalloc fault needs to sync up PGD/PTE entry from init_mm to current
task's "active_mm". ARC vmalloc fault handler however was using mm.
A vmalloc fault for non user task context (actually pre-userland, from
init thread's open for /dev/console) caused the handler to deref NULL mm
(for mm->pgd)
The reasons it worked so far is amazing:
1. By default (!SMP), vmalloc fault handler uses a cached value of PGD.
In SMP that MMU register is repurposed hence need for mm pointer deref.
2. In pre-3.12 SMP kernel, the problem triggering vmalloc didn't exist in
pre-userland code path - it was introduced with commit 20bafb3d23d108bc
"n_tty: Move buffers into n_tty_data"
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Cc: Gilad Ben-Yossef <gilad@benyossef.com>
Cc: Noam Camus <noamc@ezchip.com>
Cc: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/arc/mm/fault.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c index 689ffd86d5e..331a0846628 100644 --- a/arch/arc/mm/fault.c +++ b/arch/arc/mm/fault.c @@ -16,7 +16,7 @@ #include <linux/kdebug.h> #include <asm/pgalloc.h> -static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address) +static int handle_vmalloc_fault(unsigned long address) { /* * Synchronize this task's top level page-table @@ -26,7 +26,7 @@ static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address) pud_t *pud, *pud_k; pmd_t *pmd, *pmd_k; - pgd = pgd_offset_fast(mm, address); + pgd = pgd_offset_fast(current->active_mm, address); pgd_k = pgd_offset_k(address); if (!pgd_present(*pgd_k)) @@ -72,7 +72,7 @@ void do_page_fault(struct pt_regs *regs, int write, unsigned long address, * nothing more. */ if (address >= VMALLOC_START && address <= VMALLOC_END) { - ret = handle_vmalloc_fault(mm, address); + ret = handle_vmalloc_fault(address); if (unlikely(ret)) goto bad_area_nosemaphore; else |