Skip to contentSkip to conversation

Fix hugepage crash on failing mmap()

PATCH New David Gibson 1 participant 1 message Aug 5, 2005

Subsystems (2)
Memory management HugeTLB
lore
Share & tools
lore

David Gibson

author
#0 lore raw

PATCH 1/1 Fix hugepage crash on failing mmap()

Andrew/Linus, please apply:

This patch fixes a crash in the hugepage code. unmap_hugepage_area() was assuming that (due to prefault) PTEs must exist for all the area in question. However, this may not be the case, if mmap() encounters an error before the prefault and calls unmap_region() to clean up any partial mapping.

Depending on the hugepage configuration, this crash can be triggered by an unpriveleged user.

Signed-off-by David Gibson <[email protected]>
mm/hugetlb.c +10 -1
Index: working-2.6/mm/hugetlb.c
===================================================================
@@ -301,6 +301,7 @@
 {
 	struct mm_struct *mm = vma->vm_mm;
 	unsigned long address;
+	pte_t *ptep;
 	pte_t pte;
 	struct page *page;
 

@@ -309,9 +310,17 @@
 	BUG_ON(end & ~HPAGE_MASK);
 
 	for (address = start; address < end; address += HPAGE_SIZE) {
-		pte = huge_ptep_get_and_clear(mm, address, huge_pte_offset(mm, address));
+		ptep = huge_pte_offset(mm, address);
+		if (! ptep)
+			/* This can happen on truncate, or if an
+			 * mmap() is aborted due to an error before
+			 * the prefault */
+			continue;
+
+		pte = huge_ptep_get_and_clear(mm, address, ptep);
 		if (pte_none(pte))
 			continue;
+
 		page = pte_page(pte);
 		put_page(page);
 	}
Signature · 4 lines
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/people/dgibson