linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Tom Hromatka <tom.hromatka@oracle.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.10 03/62] sparc64: Fix kernel panic due to erroneous #ifdef surrounding pmd_write()
Date: Mon,  1 May 2017 14:34:16 -0700	[thread overview]
Message-ID: <20170501212730.907110052@linuxfoundation.org> (raw)
In-Reply-To: <20170501212730.774855694@linuxfoundation.org>

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tom Hromatka <tom.hromatka@oracle.com>


[ Upstream commit 9ae34dbd8afd790cb5f52467e4f816434379eafa ]

This commit moves sparc64's prototype of pmd_write() outside
of the CONFIG_TRANSPARENT_HUGEPAGE ifdef.

In 2013, commit a7b9403f0e6d ("sparc64: Encode huge PMDs using PTE
encoding.") exposed a path where pmd_write() could be called without
CONFIG_TRANSPARENT_HUGEPAGE defined.  This can result in the panic below.

The diff is awkward to read, but the changes are straightforward.
pmd_write() was moved outside of #ifdef CONFIG_TRANSPARENT_HUGEPAGE.
Also, __HAVE_ARCH_PMD_WRITE was defined.

kernel BUG at include/asm-generic/pgtable.h:576!
              \|/ ____ \|/
              "@'/ .. \`@"
              /_| \__/ |_\
                 \__U_/
oracle_8114_cdb(8114): Kernel bad sw trap 5 [#1]
CPU: 120 PID: 8114 Comm: oracle_8114_cdb Not tainted
4.1.12-61.7.1.el6uek.rc1.sparc64 #1
task: fff8400700a24d60 ti: fff8400700bc4000 task.ti: fff8400700bc4000
TSTATE: 0000004411e01607 TPC: 00000000004609f8 TNPC: 00000000004609fc Y:
00000005    Not tainted
TPC: <gup_huge_pmd+0x198/0x1e0>
g0: 000000000001c000 g1: 0000000000ef3954 g2: 0000000000000000 g3: 0000000000000001
g4: fff8400700a24d60 g5: fff8001fa5c10000 g6: fff8400700bc4000 g7: 0000000000000720
o0: 0000000000bc5058 o1: 0000000000000240 o2: 0000000000006000 o3: 0000000000001c00
o4: 0000000000000000 o5: 0000048000080000 sp: fff8400700bc6ab1 ret_pc: 00000000004609f0
RPC: <gup_huge_pmd+0x190/0x1e0>
l0: fff8400700bc74fc l1: 0000000000020000 l2: 0000000000002000 l3: 0000000000000000
l4: fff8001f93250950 l5: 000000000113f800 l6: 0000000000000004 l7: 0000000000000000
i0: fff8400700ca46a0 i1: bd0000085e800453 i2: 000000026a0c4000 i3: 000000026a0c6000
i4: 0000000000000001 i5: fff800070c958de8 i6: fff8400700bc6b61 i7: 0000000000460dd0
I7: <gup_pud_range+0x170/0x1a0>
Call Trace:
 [0000000000460dd0] gup_pud_range+0x170/0x1a0
 [0000000000460e84] get_user_pages_fast+0x84/0x120
 [00000000006f5a18] iov_iter_get_pages+0x98/0x240
 [00000000005fa744] do_direct_IO+0xf64/0x1e00
 [00000000005fbbc0] __blockdev_direct_IO+0x360/0x15a0
 [00000000101f74fc] ext4_ind_direct_IO+0xdc/0x400 [ext4]
 [00000000101af690] ext4_ext_direct_IO+0x1d0/0x2c0 [ext4]
 [00000000101af86c] ext4_direct_IO+0xec/0x220 [ext4]
 [0000000000553bd4] generic_file_read_iter+0x114/0x140
 [00000000005bdc2c] __vfs_read+0xac/0x100
 [00000000005bf254] vfs_read+0x54/0x100
 [00000000005bf368] SyS_pread64+0x68/0x80

Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sparc/include/asm/pgtable_64.h |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -673,26 +673,27 @@ static inline unsigned long pmd_pfn(pmd_
 	return pte_pfn(pte);
 }
 
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-static inline unsigned long pmd_dirty(pmd_t pmd)
+#define __HAVE_ARCH_PMD_WRITE
+static inline unsigned long pmd_write(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_dirty(pte);
+	return pte_write(pte);
 }
 
-static inline unsigned long pmd_young(pmd_t pmd)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static inline unsigned long pmd_dirty(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_young(pte);
+	return pte_dirty(pte);
 }
 
-static inline unsigned long pmd_write(pmd_t pmd)
+static inline unsigned long pmd_young(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_write(pte);
+	return pte_young(pte);
 }
 
 static inline unsigned long pmd_trans_huge(pmd_t pmd)

  parent reply	other threads:[~2017-05-01 21:48 UTC|newest]

Thread overview: 67+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-05-01 21:34 [PATCH 4.10 00/62] 4.10.14-stable review Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 01/62] ping: implement proper locking Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 02/62] sparc64: kern_addr_valid regression Greg Kroah-Hartman
2017-05-01 21:34 ` Greg Kroah-Hartman [this message]
2017-05-01 21:34 ` [PATCH 4.10 04/62] net: neigh: guard against NULL solicit() method Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 05/62] net: phy: handle state correctly in phy_stop_machine Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 06/62] kcm: return immediately after copy_from_user() failure Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 07/62] secure_seq: downgrade to per-host timestamp offsets Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 08/62] bpf: improve verifier packet range checks Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 09/62] net/mlx5: Avoid dereferencing uninitialized pointer Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 10/62] l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 11/62] l2tp: purge socket queues in the .destruct() callback Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 12/62] net/packet: fix overflow in check for tp_frame_nr Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 13/62] net/packet: fix overflow in check for tp_reserve Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 14/62] openvswitch: Fix ovs_flow_key_update() Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 15/62] l2tp: take reference on sessions being dumped Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 16/62] l2tp: fix PPP pseudo-wire auto-loading Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 17/62] net: ipv4: fix multipath RTM_GETROUTE behavior when iif is given Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 18/62] sctp: listen on the sock only when its state is listening or closed Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 19/62] tcp: clear saved_syn in tcp_disconnect() Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 20/62] ipv6: Fix idev->addr_list corruption Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 21/62] net-timestamp: avoid use-after-free in ip_recv_error Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 22/62] net: vrf: Fix setting NLM_F_EXCL flag when adding l3mdev rule Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 23/62] sh_eth: unmap DMA buffers when freeing rings Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 24/62] ipv6: sr: fix out-of-bounds access in SRH validation Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 26/62] ipv6: sr: fix double free of skb after handling invalid SRH Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 27/62] ipv6: fix source routing Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 28/62] gso: Validate assumption of frag_list segementation Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 29/62] net: ipv6: RTF_PCPU should not be settable from userspace Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 30/62] netpoll: Check for skb->queue_mapping Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 31/62] ip6mr: fix notification device destruction Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 32/62] net/mlx5: Fix driver load bad flow when having fw initializing timeout Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 33/62] net/mlx5: E-Switch, Correctly deal with inline mode on ConnectX-5 Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 34/62] net/mlx5e: Fix small packet threshold Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 35/62] net/mlx5e: Fix ETHTOOL_GRXCLSRLALL handling Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 36/62] tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 37/62] tcp: mark skbs with SCM_TIMESTAMPING_OPT_STATS Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 38/62] macvlan: Fix device ref leak when purging bc_queue Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 39/62] net: ipv6: regenerate host route if moved to gc list Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 40/62] net: phy: fix auto-negotiation stall due to unavailable interrupt Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 41/62] ipv6: check skb->protocol before lookup for nexthop Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 42/62] tcp: memset ca_priv data to 0 properly Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 43/62] ipv6: check raw payload size correctly in ioctl Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 44/62] ALSA: oxfw: fix regression to handle Stanton SCS.1m/1d Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 45/62] ALSA: firewire-lib: fix inappropriate assignment between signed/unsigned type Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 46/62] ALSA: seq: Dont break snd_use_lock_sync() loop by timeout Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 47/62] scsi: return correct blkprep status code in case scsi_init_io() fails Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 48/62] ARC: [plat-eznps] Fix build error Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 49/62] MIPS: KGDB: Use kernel context for sleeping threads Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 50/62] MIPS: cevt-r4k: Fix out-of-bounds array access Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 51/62] MIPS: Avoid BUG warning in arch_check_elf Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 52/62] p9_client_readdir() fix Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 53/62] ASoC: intel: Fix PM and non-atomic crash in bytcr drivers Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 56/62] nfsd4: minor NFSv2/v3 write decoding cleanup Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 58/62] ceph: fix recursion between ceph_set_acl() and __ceph_setattr() Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 59/62] macsec: avoid heap overflow in skb_to_sgvec Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 60/62] net: can: usb: gs_usb: Fix buffer on stack Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 61/62] cpu/hotplug: Serialize callback invocations proper Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 62/62] ftrace/x86: Fix triple fault with graph tracing and suspend-to-ram Greg Kroah-Hartman
     [not found] ` <20170501212732.861897612@linuxfoundation.org>
2017-05-02  1:14   ` [PATCH 4.10 54/62] Input: i8042 - add Clevo P650RS to the i8042 reset list Ed Bordin
2017-05-02  1:22     ` Dmitry Torokhov
2017-05-02  2:16       ` Ed Bordin
     [not found] ` <5908121b.4778370a.18c89.ea22@mx.google.com>
2017-05-02 13:54   ` [PATCH 4.10 00/62] 4.10.14-stable review Shuah Khan
2017-05-02 17:05     ` Greg Kroah-Hartman
2017-05-02 17:05   ` Greg Kroah-Hartman
2017-05-02 17:36 ` Guenter Roeck
2017-05-02 18:33   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170501212730.907110052@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tom.hromatka@oracle.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).