mm: pagemap: limit scan to virtual region being asked

pagemap_read scans through the virtual address space of a task till it prepares 'count' pagemaps or it reaches end of task.

This presents a problem when the page walk doesn't happen for vma with VM_PFNMAP set. In which case walk is silently skipped and no pagemap is prepare, in turn making pagemap_read to scan through task end, even crossing beyond 'count', landing into a different vma region. This leads to wrong presentation of mappings for that vma.

Fix this by limiting end_vaddr to the end of the virtual address region being scanned.

Signed-off-by Shiraz Hashim <[email protected]>

---
 fs/proc/task_mmu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

fs/proc/task_mmu.c +3 -1

index 246eae8..04362e4 100644
@@ -1270,7 +1270,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 	src = *ppos;
 	svpfn = src / PM_ENTRY_BYTES;
 	start_vaddr = svpfn << PAGE_SHIFT;
-	end_vaddr = TASK_SIZE_OF(task);
+	end_vaddr = start_vaddr + ((count / PM_ENTRY_BYTES) << PAGE_SHIFT);
+	if ((end_vaddr > TASK_SIZE_OF(task)) || (end_vaddr < start_vaddr))
+		end_vaddr = TASK_SIZE_OF(task);
 
 	/* watch out for wraparound */
 	if (svpfn > TASK_SIZE_OF(task) >> PAGE_SHIFT)

Signature · 8 lines

QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected].  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Quoted 11 lines · Shiraz Hashim

pagemap_read scans through the virtual address space of a task till it prepares 'count' pagemaps or it reaches end of task.

This presents a problem when the page walk doesn't happen for vma with VM_PFNMAP set. In which case walk is silently skipped and no pagemap is prepare, in turn making pagemap_read to scan through task end, even crossing beyond 'count', landing into a different vma region. This leads to wrong presentation of mappings for that vma.

Quoted 4 lines

Fix this by limiting end_vaddr to the end of the virtual address region being scanned.

Signed-off-by Shiraz Hashim <[email protected]>

This patch works in some case, but there still seems a problem in another case.

Consider that we have two vmas within some narrow (PAGEMAP_WALK_SIZE) region. One vma in lower address is VM_PFNMAP, and the other vma in higher address is not. Then a single call of walk_page_range() skips the first vma and scans the second vma, but the pagemap record of the second vma will be stored on the wrong offset in the buffer, because we just skip vma(VM_PFNMAP) without calling any callbacks (within which add_to_pagemap() increments pm.pos).

So calling pte_hole() for vma(VM_PFNMAP) looks a better fix to me.

Quoted 11 lines · Shiraz Hashim

pagemap_read scans through the virtual address space of a task till it prepares 'count' pagemaps or it reaches end of task.

This presents a problem when the page walk doesn't happen for vma with VM_PFNMAP set. In which case walk is silently skipped and no pagemap is prepare, in turn making pagemap_read to scan through task end, even crossing beyond 'count', landing into a different vma region. This leads to wrong presentation of mappings for that vma.

Quoted 4 lines

Fix this by limiting end_vaddr to the end of the virtual address region being scanned.

Signed-off-by Shiraz Hashim <[email protected]>

This patch works in some case, but there still seems a problem in another case.

Consider that we have two vmas within some narrow (PAGEMAP_WALK_SIZE) region. One vma in lower address is VM_PFNMAP, and the other vma in higher address is not. Then a single call of walk_page_range() skips the first vma and scans the second vma, but the pagemap record of the second vma will be stored on the wrong offset in the buffer, because we just skip vma(VM_PFNMAP) without calling any callbacks (within which add_to_pagemap() increments pm.pos).

So calling pte_hole() for vma(VM_PFNMAP) looks a better fix to me.

Quoted 26 lines · On Wed, 14 Jan 2015 01:08:40 +0000 Naoya Horiguchi <[email protected]>…

Quoted 11 lines · Shiraz Hashim

pagemap_read scans through the virtual address space of a task till it prepares 'count' pagemaps or it reaches end of task.

This presents a problem when the page walk doesn't happen for vma with VM_PFNMAP set. In which case walk is silently skipped and no pagemap is prepare, in turn making pagemap_read to scan through task end, even crossing beyond 'count', landing into a different vma region. This leads to wrong presentation of mappings for that vma.

Quoted 4 lines

Fix this by limiting end_vaddr to the end of the virtual address region being scanned.

Signed-off-by Shiraz Hashim <[email protected]>

This patch works in some case, but there still seems a problem in another case.

Consider that we have two vmas within some narrow (PAGEMAP_WALK_SIZE) region. One vma in lower address is VM_PFNMAP, and the other vma in higher address is not. Then a single call of walk_page_range() skips the first vma and scans the second vma, but the pagemap record of the second vma will be stored on the wrong offset in the buffer, because we just skip vma(VM_PFNMAP) without calling any callbacks (within which add_to_pagemap() increments pm.pos).

Quoted 2 lines

So calling pte_hole() for vma(VM_PFNMAP) looks a better fix to me.

Can we get this finished off? ASAP, please.