On Wed, Jul 16, 2014 at 12:42 AM, Andrew Morton
<akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
> On Tue, 15 Jul 2014 15:58:32 +0400 Konstantin Khlebnikov <k.khlebnikov@xxxxxxxxxxx> wrote:
>
>> From: Konstantin Khlebnikov <koct9i@xxxxxxxxx>
>>
>> Faulting around non-linear page-fault has no sense and
>> breaks logic in do_fault_around because pgoff is shifted.
>>
>
> Please be a lot more careful with the changelogs? This one failed to
> describe the effects of the bug, failed to adequately describe the bug
> itself, failed to describe the offending commits and failed to identify
> which kernel versions need the patch.
Sorry for that. I thought I had already lost that bug-fixing race.
>
> Sigh. I went back and assembled the necessary information, below.
> Please check it.
>
>
>
> From: Konstantin Khlebnikov <koct9i@xxxxxxxxx>
> Subject: mm: do not call do_fault_around for non-linear fault
>
> Ingo Korb reported that "repeated mapping of the same file on tmpfs using
> remap_file_pages sometimes triggers a BUG at mm/filemap.c:202 when the
> process exits". He bisected the bug to d7c1755179b82d ("mm: implement
> ->map_pages for shmem/tmpfs"), although the bug was actually added by
> 8c6e50b0290c4 ("mm: introduce vm_ops->map_pages()").
>
> Problem is caused by calling do_fault_around for _non-linear_ faiult. In
> this case pgoff is shifted and might become negative during calculation.
>
> Faulting around non-linear page-fault has no sense and breaks logic in
> do_fault_around because pgoff is shifted.
>
> Signed-off-by: Konstantin Khlebnikov <koct9i@xxxxxxxxx>
> Reported-by: "Ingo Korb" <ingo.korb@xxxxxxxxxxxxxx>
> Tested-by: "Ingo Korb" <ingo.korb@xxxxxxxxxxxxxx>
> Cc: Hugh Dickins <hughd@xxxxxxxxxx>
> Cc: Sasha Levin <sasha.levin@xxxxxxxxxx>
> Cc: Dave Jones <davej@xxxxxxxxxx>
> Cc: Ning Qu <quning@xxxxxxxxxx>
> Cc: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx> [3.15.x]
> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> ---
>
> mm/memory.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff -puN mm/memory.c~mm-do-not-call-do_fault_around-for-non-linear-fault mm/memory.c
> --- a/mm/memory.c~mm-do-not-call-do_fault_around-for-non-linear-fault
> +++ a/mm/memory.c
> @@ -2882,7 +2882,8 @@ static int do_read_fault(struct mm_struc
> * if page by the offset is not ready to be mapped (cold cache or
> * something).
> */
> - if (vma->vm_ops->map_pages && fault_around_pages() > 1) {
> + if (vma->vm_ops->map_pages && !(flags & FAULT_FLAG_NONLINEAR) &&
> + fault_around_pages() > 1) {
> pte = pte_offset_map_lock(mm, pmd, address, &ptl);
> do_fault_around(vma, address, pte, pgoff, flags);
> if (!pte_same(*pte, orig_pte))
> _
>
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>