[lkml]   [2013]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[ 036/184] mm: fix vma_resv_map() NULL pointer
2.6.32-longterm review patch.  If anyone has any objections, please let me know.


From: Dave Hansen <>

commit 4523e1458566a0e8ecfaff90f380dd23acc44d27 upstream

hugetlb_reserve_pages() can be used for either normal file-backed
hugetlbfs mappings, or MAP_HUGETLB. In the MAP_HUGETLB, semi-anonymous
mode, there is not a VMA around. The new call to resv_map_put() assumed
that there was, and resulted in a NULL pointer dereference:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
IP: vma_resv_map+0x9/0x30
PGD 141453067 PUD 1421e1067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
Pid: 14006, comm: trinity-child6 Not tainted 3.4.0+ #36
RIP: vma_resv_map+0x9/0x30
Process trinity-child6 (pid: 14006, threadinfo ffff8801414e0000, task ffff8801414f26b0)
Call Trace:

This was reported by Dave Jones, but was reproducible with the
libhugetlbfs test cases, so shame on me for not running them in the
first place.

With this, the oops is gone, and the output of libhugetlbfs's is identical to plain 3.4 again.

[ Marked for stable, since this was introduced by commit c50ac050811d
("hugetlb: fix resv_map leak in error path") which was also marked for
stable ]

Reported-by: Dave Jones <>
Cc: Mel Gorman <>
Cc: KOSAKI Motohiro <>
Cc: Christoph Lameter <>
Cc: Andrea Arcangeli <>
Cc: Andrew Morton <>
Cc: <>
Signed-off-by: Linus Torvalds <>
[dannf: backported to Debian's 2.6.32]
Signed-off-by: Willy Tarreau <>
mm/hugetlb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 3d61035..b435d1f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2517,7 +2517,8 @@ int hugetlb_reserve_pages(struct inode *inode,
region_add(&inode->i_mapping->private_list, from, to);
return 0;
- resv_map_put(vma);
+ if (vma)
+ resv_map_put(vma);
return ret;


 \ /
  Last update: 2013-06-05 01:01    [W:0.520 / U:8.708 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site