lkml.org 
[lkml]   [2016]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 006/107] mm: avoid setting up anonymous pages into file mapping
    Date
    From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>

    3.4.111-rc1 review patch. If anyone has any objections, please let me know.

    ------------------


    commit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d upstream.

    Reading page fault handler code I've noticed that under right
    circumstances kernel would map anonymous pages into file mappings: if
    the VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated
    on ->mmap(), kernel would handle page fault to not populated pte with
    do_anonymous_page().

    Let's change page fault handler to use do_anonymous_page() only on
    anonymous VMA (->vm_ops == NULL) and make sure that the VMA is not
    shared.

    For file mappings without vm_ops->fault() or shred VMA without vm_ops,
    page fault on pte_none() entry would lead to SIGBUS.

    Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Acked-by: Oleg Nesterov <oleg@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Willy Tarreau <w@1wt.eu>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [lizf: Backported to 3.4: adjust context]
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    ---
    mm/memory.c | 17 +++++++++++++----
    1 file changed, 13 insertions(+), 4 deletions(-)

    diff --git a/mm/memory.c b/mm/memory.c
    index 02aef93..4774579 100644
    --- a/mm/memory.c
    +++ b/mm/memory.c
    @@ -3173,6 +3173,14 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,

    pte_unmap(page_table);

    + /* File mapping without ->vm_ops ? */
    + if (vma->vm_flags & VM_SHARED)
    + return VM_FAULT_SIGBUS;
    +
    + /* File mapping without ->vm_ops ? */
    + if (vma->vm_flags & VM_SHARED)
    + return VM_FAULT_SIGBUS;
    +
    /* Check if we need to add a guard page to the stack */
    if (check_stack_guard_page(vma, address) < 0)
    return VM_FAULT_SIGSEGV;
    @@ -3432,6 +3440,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;

    pte_unmap(page_table);
    + /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
    + if (!vma->vm_ops->fault)
    + return VM_FAULT_SIGBUS;
    return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
    }

    @@ -3490,11 +3501,9 @@ int handle_pte_fault(struct mm_struct *mm,
    entry = *pte;
    if (!pte_present(entry)) {
    if (pte_none(entry)) {
    - if (vma->vm_ops) {
    - if (likely(vma->vm_ops->fault))
    - return do_linear_fault(mm, vma, address,
    + if (vma->vm_ops)
    + return do_linear_fault(mm, vma, address,
    pte, pmd, flags, entry);
    - }
    return do_anonymous_page(mm, vma, address,
    pte, pmd, flags);
    }
    --
    1.9.1
    \
     
     \ /
      Last update: 2016-03-16 10:21    [W:3.765 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site