This is a note to let you know that I've just added the patch titled powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: powerpc-mm-fix-pte_pagesize_index-crash-on-4k-w-64k-hash.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 74b5037baa2011a2799e2c43adde7d171b072f9e Mon Sep 17 00:00:00 2001 From: Michael Ellerman <mpe@xxxxxxxxxxxxxx> Date: Fri, 7 Aug 2015 16:19:43 +1000 Subject: powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash From: Michael Ellerman <mpe@xxxxxxxxxxxxxx> commit 74b5037baa2011a2799e2c43adde7d171b072f9e upstream. The powerpc kernel can be built to have either a 4K PAGE_SIZE or a 64K PAGE_SIZE. However when built with a 4K PAGE_SIZE there is an additional config option which can be enabled, PPC_HAS_HASH_64K, which means the kernel also knows how to hash a 64K page even though the base PAGE_SIZE is 4K. This is used in one obscure configuration, to support 64K pages for SPU local store on the Cell processor when the rest of the kernel is using 4K pages. In this configuration, pte_pagesize_index() is defined to just pass through its arguments to get_slice_psize(). However pte_pagesize_index() is called for both user and kernel addresses, whereas get_slice_psize() only knows how to handle user addresses. This has been broken forever, however until recently it happened to work. That was because in get_slice_psize() the large kernel address would cause the right shift of the slice mask to return zero. However in commit 7aa0727f3302 ("powerpc/mm: Increase the slice range to 64TB"), the get_slice_psize() code was changed so that instead of a right shift we do an array lookup based on the address. When passed a kernel address this means we index way off the end of the slice array and return random junk. That is only fatal if we happen to hit something non-zero, but when we do return a non-zero value we confuse the MMU code and eventually cause a check stop. This fix is ugly, but simple. When we're called for a kernel address we return 4K, which is always correct in this configuration, otherwise we use the slice mask. Fixes: 7aa0727f3302 ("powerpc/mm: Increase the slice range to 64TB") Reported-by: Cyril Bur <cyrilbur@xxxxxxxxx> Signed-off-by: Michael Ellerman <mpe@xxxxxxxxxxxxxx> Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@xxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/powerpc/include/asm/pgtable-ppc64.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) --- a/arch/powerpc/include/asm/pgtable-ppc64.h +++ b/arch/powerpc/include/asm/pgtable-ppc64.h @@ -135,7 +135,19 @@ #define pte_iterate_hashed_end() } while(0) #ifdef CONFIG_PPC_HAS_HASH_64K -#define pte_pagesize_index(mm, addr, pte) get_slice_psize(mm, addr) +/* + * We expect this to be called only for user addresses or kernel virtual + * addresses other than the linear mapping. + */ +#define pte_pagesize_index(mm, addr, pte) \ + ({ \ + unsigned int psize; \ + if (is_kernel_addr(addr)) \ + psize = MMU_PAGE_4K; \ + else \ + psize = get_slice_psize(mm, addr); \ + psize; \ + }) #else #define pte_pagesize_index(mm, addr, pte) MMU_PAGE_4K #endif Patches currently in stable-queue which might be from mpe@xxxxxxxxxxxxxx are queue-4.1/powerpc-uncomment-and-make-enable_kernel_vsx-routine-available.patch queue-4.1/powerpc-mm-recompute-hash-value-after-a-failed-update.patch queue-4.1/powerpc-mm-fix-pte_pagesize_index-crash-on-4k-w-64k-hash.patch queue-4.1/powerpc-boot-specify-abi-v2-when-building-an-le-boot-wrapper.patch queue-4.1/powerpc-eeh-probe-after-unbalanced-kref-check.patch queue-4.1/powerpc-rtas-introduce-rtas_get_sensor_fast-for-irq-handlers.patch queue-4.1/powerpc-eeh-fix-fenced-phb-caused-by-eeh_slot_error_detail.patch queue-4.1/cxl-remove-racy-attempt-to-force-eeh-invocation-in-reset.patch queue-4.1/cxl-fix-unbalanced-pci_dev_get-in-cxl_probe.patch queue-4.1/powerpc-pseries-fix-corrupted-pdn-list.patch queue-4.1/crypto-vmx-adding-enable_kernel_vsx-to-access-vsx-instructions.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html