lkml.org 
[lkml]   [2009]   [Jul]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[tip:core/urgent] futexes: Fix infinite loop in get_futex_key() on huge page
    Commit-ID:  ce2ae53b750abfaa012ce408e93da131a5b5649b
    Gitweb: http://git.kernel.org/tip/ce2ae53b750abfaa012ce408e93da131a5b5649b
    Author: Sonny Rao <sonnyrao@us.ibm.com>
    AuthorDate: Fri, 10 Jul 2009 18:13:13 -0500
    Committer: Ingo Molnar <mingo@elte.hu>
    CommitDate: Sat, 11 Jul 2009 12:40:44 +0200

    futexes: Fix infinite loop in get_futex_key() on huge page

    get_futex_key() can infinitely loop if it is called on a
    virtual address that is within a huge page but not aligned to
    the beginning of that page. The call to get_user_pages_fast
    will return the struct page for a sub-page within the huge page
    and the check for page->mapping will always fail.

    The fix is to call compound_head on the page before checking
    that it's mapped.

    Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
    Acked-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@kernel.org
    Cc: anton@samba.org
    Cc: rajamony@us.ibm.com
    Cc: speight@us.ibm.com
    Cc: mstephen@us.ibm.com
    Cc: grimm@us.ibm.com
    Cc: mikey@ozlabs.au.ibm.com
    LKML-Reference: <20090710231313.GA23572@us.ibm.com>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>


    ---
    kernel/futex.c | 1 +
    1 files changed, 1 insertions(+), 0 deletions(-)

    diff --git a/kernel/futex.c b/kernel/futex.c
    index 794c862..0672ff8 100644
    --- a/kernel/futex.c
    +++ b/kernel/futex.c
    @@ -247,6 +247,7 @@ again:
    if (err < 0)
    return err;

    + page = compound_head(page);
    lock_page(page);
    if (!page->mapping) {
    unlock_page(page);

    \
     
     \ /
      Last update: 2009-07-11 12:45    [W:0.043 / U:60.804 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site