Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7bf07f3d authored by Adam Litke's avatar Adam Litke Committed by Linus Torvalds
Browse files

[PATCH] hugetlb: move stale pte check into huge_pte_alloc() 

Initial Post (Wed, 17 Aug 2005)

This patch moves the
	if (! pte_none(*pte))
		hugetlb_clean_stale_pgtable(pte);
logic into huge_pte_alloc() so all of its callers can be immune to the bug
described by Kenneth Chen at http://lkml.org/lkml/2004/6/16/246



> It turns out there is a bug in hugetlb_prefault(): with 3 level page table,
> huge_pte_alloc() might return a pmd that points to a PTE page. It happens
> if the virtual address for hugetlb mmap is recycled from previously used
> normal page mmap. free_pgtables() might not scrub the pmd entry on
> munmap and hugetlb_prefault skips on any pmd presence regardless what type
> it is.

Unless I am missing something, it seems more correct to place the check inside
huge_pte_alloc() to prevent a the same bug wherever a huge pte is allocated.
It also allows checking for this condition when lazily faulting huge pages
later in the series.

Signed-off-by: default avatarAdam Litke <agl@us.ibm.com>
Cc: <linux-mm@kvack.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 32e51a8c

arch/i386/mm/hugetlbpage.c

+11 −2
Original line number Diff line number Diff line
@@ -22,12 +22,21 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr) 
{

	pgd_t *pgd;

	pud_t *pud;

	pmd_t *pmd = NULL;

	pmd_t *pmd;

	pte_t *pte = NULL;



	pgd = pgd_offset(mm, addr);

	pud = pud_alloc(mm, pgd, addr);

	pmd = pmd_alloc(mm, pud, addr);

	return (pte_t *) pmd;



	if (!pmd)

		goto out;



	pte = (pte_t *) pmd;

	if (!pte_none(*pte) && !pte_huge(*pte))

		hugetlb_clean_stale_pgtable(pte);

out:

	return pte;

}



pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)

mm/hugetlb.c

+0 −2
Original line number Diff line number Diff line
@@ -360,8 +360,6 @@ int hugetlb_prefault(struct address_space *mapping, struct vm_area_struct *vma) 
			ret = -ENOMEM;

			goto out;

		}

		if (! pte_none(*pte))

			hugetlb_clean_stale_pgtable(pte);



		idx = ((addr - vma->vm_start) >> HPAGE_SHIFT)

			+ (vma->vm_pgoff >> (HPAGE_SHIFT - PAGE_SHIFT));