Commit c0e7cad9 authored Feb 12, 2015 by Mel Gorman Committed by Linus Torvalds Feb 12, 2015

mm: numa: add paranoid check around pte_protnone_numa



pte_protnone_numa is only safe to use after VMA checks for PROT_NONE are
complete.  Treating a real PROT_NONE PTE as a NUMA hinting fault is going
to result in strangeness so add a check for it.  BUG_ON looks like
overkill but if this is hit then it's a serious bug that could result in
corruption so do not even try recovering.  It would have been more
comprehensive to check VMA flags in pte_protnone_numa but it would have
made the API ugly just for a debugging check.

Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Dave Jones <davej@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Kirill Shutemov <kirill.shutemov@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent c819f37e

mm/huge_memory.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1262,6 +1262,9 @@ int do_huge_pmd_numa_page(struct mm_struct mm, struct vm_area_struct vma,
		bool migrated = false;
		int flags = 0;

		/* A PROT_NONE fault should not end up here */
		BUG_ON(!(vma->vm_flags & (VM_READ \| VM_EXEC \| VM_WRITE)));

		ptl = pmd_lock(mm, pmdp);
		if (unlikely(!pmd_same(pmd, *pmdp)))
		goto out_unlock;

mm/memory.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -3013,6 +3013,9 @@ static int do_numa_page(struct mm_struct mm, struct vm_area_struct vma,
		bool migrated = false;
		int flags = 0;

		/* A PROT_NONE fault should not end up here */
		BUG_ON(!(vma->vm_flags & (VM_READ \| VM_EXEC \| VM_WRITE)));

		/*
		* The "pte" at this point cannot be used safely without
		* validation through pte_unmap_same(). It's of NUMA type but