Messages in this thread | | | Date | Sat, 11 Jul 2009 12:14:47 +0200 (CEST) | From | Thomas Gleixner <> | Subject | Re: [PATCH] futexs: fix infinite loop in get_futex_key on huge page |
| |
On Sat, 11 Jul 2009, Ingo Molnar wrote: > > * Sonny Rao <sonnyrao@us.ibm.com> wrote: > > > get_futex_key() can infinitely loop if it is called on a virtual > > address that is within a huge page but not aligned to the > > beginning of that page. The call to get_user_pages_fast will > > return the struct page for a sub-page within the huge page and the > > check for page->mapping will always fail. > > > > The fix is to call compound_head on the page before checking that > > it's mapped. > > > > Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com> > > Cc: Ingo Molnar <mingo@redhat.com> > > Cc: stable@kernel.org > > > > Index: linux-2.6.31-rc2/kernel/futex.c > > =================================================================== > > --- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500 > > +++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500 > > @@ -247,6 +247,7 @@ > > if (err < 0) > > return err; > > > > + page = compound_head(page); > > lock_page(page); > > if (!page->mapping) { > > unlock_page(page); > > Nice catch! Applied it to tip:core/urgent - Thomas, do you agree > with the fix?
Acked-by-me.
| |