The patch titled
Subject: mm/page_owner: fix possible access violation
has been removed from the -mm tree. Its filename was
mm-page_owner-fix-possible-access-violation.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Joonsoo Kim <js1304@xxxxxxxxx>
Subject: mm/page_owner: fix possible access violation
When I tested my new patches, I found that page pointer which is used for
setting page_owner information is changed. This is because page pointer
is used to set new migratetype in loop. After this work, page pointer
could be out of bound. If this wrong pointer is used for page_owner,
access violation happens. Below is error message that I got.
[ 6175.025217] BUG: unable to handle kernel paging request at 0000000000b00018
[ 6175.026400] IP: [<ffffffff81025f30>] save_stack_address+0x30/0x40
[ 6175.027341] PGD 1af2d067 PUD 166e0067 PMD 0
[ 6175.028129] Oops: 0002 [#1] SMP
snip...
[ 6175.055349] Call Trace:
[ 6175.055780] [<ffffffff81018c0f>] print_context_stack+0xcf/0x100
[ 6175.056794] [<ffffffff810f8552>] ? __module_text_address+0x12/0x70
[ 6175.057848] [<ffffffff810177cf>] dump_trace+0x15f/0x320
[ 6175.058751] [<ffffffff8106b140>] ? do_flush_tlb_all+0x50/0x50
[ 6175.059732] [<ffffffff810f5529>] ? smp_call_function_single+0xb9/0x120
[ 6175.060856] [<ffffffff81025e3f>] save_stack_trace+0x2f/0x50
[ 6175.061812] [<ffffffff811e3366>] __set_page_owner+0x46/0x70
[ 6175.062774] [<ffffffff8117bd47>] __isolate_free_page+0x1f7/0x210
[ 6175.063804] [<ffffffff8117bd81>] split_free_page+0x21/0xb0
[ 6175.064757] [<ffffffff8119aa82>] isolate_freepages_block+0x1e2/0x410
[ 6175.065855] [<ffffffff8119b53d>] compaction_alloc+0x22d/0x2d0
[ 6175.066850] [<ffffffff811d3779>] migrate_pages+0x289/0x8b0
[ 6175.067798] [<ffffffff8119c16a>] ? isolate_migratepages_block+0x28a/0x6e0
[ 6175.068960] [<ffffffff8119a000>] ? kmalloc_slab+0xa0/0xa0
[ 6175.069892] [<ffffffff8119b310>] ? ftrace_raw_event_mm_compaction_deplete_template+0xc0/0xc0
[ 6175.071327] [<ffffffff8119ce49>] compact_zone+0x409/0x880
[ 6175.072261] [<ffffffff8119d32d>] compact_zone_order+0x6d/0x90
[ 6175.073250] [<ffffffff8119d5d0>] try_to_compact_pages+0x110/0x210
[ 6175.074297] [<ffffffff8176e9e8>] __alloc_pages_direct_compact+0x3d/0xe6
[ 6175.075427] [<ffffffff8117d42d>] __alloc_pages_nodemask+0x6cd/0x9a0
[ 6175.076517] [<ffffffff811c2bf1>] alloc_pages_current+0x91/0x100
[ 6175.077545] [<ffffffff811e7216>] runtest_store+0x296/0xa50
[ 6175.078497] [<ffffffff813a553c>] ? simple_strtoull+0x2c/0x50
[ 6175.079465] [<ffffffff812130bd>] simple_attr_write+0xbd/0xe0
[ 6175.080458] [<ffffffff811eb038>] __vfs_write+0x28/0xf0
[ 6175.081349] [<ffffffff811edc39>] ? __sb_start_write+0x49/0xf0
[ 6175.082345] [<ffffffff8130fe25>] ? security_file_permission+0x45/0xd0
[ 6175.083453] [<ffffffff811eb729>] vfs_write+0xa9/0x1b0
[ 6175.084334] [<ffffffff811ec4f6>] SyS_write+0x46/0xb0
[ 6175.085196] [<ffffffff81172803>] ? context_tracking_user_enter+0x13/0x20
[ 6175.086339] [<ffffffff81024c55>] ? syscall_trace_leave+0xa5/0x120
[ 6175.087389] [<ffffffff81779472>] system_call_fastpath+0x16/0x75
This patch fixes this error by moving up set_page_owner().
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>
Cc: Mel Gorman <mgorman@xxxxxxx>
Cc: Vlastimil Babka <vbabka@xxxxxxx>
Acked-by: Minchan Kim <minchan@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/page_alloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff -puN mm/page_alloc.c~mm-page_owner-fix-possible-access-violation mm/page_alloc.c
--- a/mm/page_alloc.c~mm-page_owner-fix-possible-access-violation
+++ a/mm/page_alloc.c
@@ -1994,6 +1994,8 @@ int __isolate_free_page(struct page *pag
zone->free_area[order].nr_free--;
rmv_page_order(page);
+ set_page_owner(page, order, 0);
+
/* Set the pageblock if the isolated page is at least a pageblock */
if (order >= pageblock_order - 1) {
struct page *endpage = page + (1 << order) - 1;
@@ -2005,7 +2007,7 @@ int __isolate_free_page(struct page *pag
}
}
- set_page_owner(page, order, 0);
+
return 1UL << order;
}
_
Patches currently in -mm which might be from js1304@xxxxxxxxx are
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
