All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Tom Hromatka <tom.hromatka@oracle.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.10 03/62] sparc64: Fix kernel panic due to erroneous #ifdef surrounding pmd_write()
Date: Mon,  1 May 2017 14:34:16 -0700	[thread overview]
Message-ID: <20170501212730.907110052@linuxfoundation.org> (raw)
In-Reply-To: <20170501212730.774855694@linuxfoundation.org>

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tom Hromatka <tom.hromatka@oracle.com>


[ Upstream commit 9ae34dbd8afd790cb5f52467e4f816434379eafa ]

This commit moves sparc64's prototype of pmd_write() outside
of the CONFIG_TRANSPARENT_HUGEPAGE ifdef.

In 2013, commit a7b9403f0e6d ("sparc64: Encode huge PMDs using PTE
encoding.") exposed a path where pmd_write() could be called without
CONFIG_TRANSPARENT_HUGEPAGE defined.  This can result in the panic below.

The diff is awkward to read, but the changes are straightforward.
pmd_write() was moved outside of #ifdef CONFIG_TRANSPARENT_HUGEPAGE.
Also, __HAVE_ARCH_PMD_WRITE was defined.

kernel BUG at include/asm-generic/pgtable.h:576!
              \|/ ____ \|/
              "@'/ .. \`@"
              /_| \__/ |_\
                 \__U_/
oracle_8114_cdb(8114): Kernel bad sw trap 5 [#1]
CPU: 120 PID: 8114 Comm: oracle_8114_cdb Not tainted
4.1.12-61.7.1.el6uek.rc1.sparc64 #1
task: fff8400700a24d60 ti: fff8400700bc4000 task.ti: fff8400700bc4000
TSTATE: 0000004411e01607 TPC: 00000000004609f8 TNPC: 00000000004609fc Y:
00000005    Not tainted
TPC: <gup_huge_pmd+0x198/0x1e0>
g0: 000000000001c000 g1: 0000000000ef3954 g2: 0000000000000000 g3: 0000000000000001
g4: fff8400700a24d60 g5: fff8001fa5c10000 g6: fff8400700bc4000 g7: 0000000000000720
o0: 0000000000bc5058 o1: 0000000000000240 o2: 0000000000006000 o3: 0000000000001c00
o4: 0000000000000000 o5: 0000048000080000 sp: fff8400700bc6ab1 ret_pc: 00000000004609f0
RPC: <gup_huge_pmd+0x190/0x1e0>
l0: fff8400700bc74fc l1: 0000000000020000 l2: 0000000000002000 l3: 0000000000000000
l4: fff8001f93250950 l5: 000000000113f800 l6: 0000000000000004 l7: 0000000000000000
i0: fff8400700ca46a0 i1: bd0000085e800453 i2: 000000026a0c4000 i3: 000000026a0c6000
i4: 0000000000000001 i5: fff800070c958de8 i6: fff8400700bc6b61 i7: 0000000000460dd0
I7: <gup_pud_range+0x170/0x1a0>
Call Trace:
 [0000000000460dd0] gup_pud_range+0x170/0x1a0
 [0000000000460e84] get_user_pages_fast+0x84/0x120
 [00000000006f5a18] iov_iter_get_pages+0x98/0x240
 [00000000005fa744] do_direct_IO+0xf64/0x1e00
 [00000000005fbbc0] __blockdev_direct_IO+0x360/0x15a0
 [00000000101f74fc] ext4_ind_direct_IO+0xdc/0x400 [ext4]
 [00000000101af690] ext4_ext_direct_IO+0x1d0/0x2c0 [ext4]
 [00000000101af86c] ext4_direct_IO+0xec/0x220 [ext4]
 [0000000000553bd4] generic_file_read_iter+0x114/0x140
 [00000000005bdc2c] __vfs_read+0xac/0x100
 [00000000005bf254] vfs_read+0x54/0x100
 [00000000005bf368] SyS_pread64+0x68/0x80

Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sparc/include/asm/pgtable_64.h |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -673,26 +673,27 @@ static inline unsigned long pmd_pfn(pmd_
 	return pte_pfn(pte);
 }
 
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-static inline unsigned long pmd_dirty(pmd_t pmd)
+#define __HAVE_ARCH_PMD_WRITE
+static inline unsigned long pmd_write(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_dirty(pte);
+	return pte_write(pte);
 }
 
-static inline unsigned long pmd_young(pmd_t pmd)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static inline unsigned long pmd_dirty(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_young(pte);
+	return pte_dirty(pte);
 }
 
-static inline unsigned long pmd_write(pmd_t pmd)
+static inline unsigned long pmd_young(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_write(pte);
+	return pte_young(pte);
 }
 
 static inline unsigned long pmd_trans_huge(pmd_t pmd)

  parent reply	other threads:[~2017-05-01 21:48 UTC|newest]

Thread overview: 67+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-05-01 21:34 [PATCH 4.10 00/62] 4.10.14-stable review Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 01/62] ping: implement proper locking Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 02/62] sparc64: kern_addr_valid regression Greg Kroah-Hartman
2017-05-01 21:34 ` Greg Kroah-Hartman [this message]
2017-05-01 21:34 ` [PATCH 4.10 04/62] net: neigh: guard against NULL solicit() method Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 05/62] net: phy: handle state correctly in phy_stop_machine Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 06/62] kcm: return immediately after copy_from_user() failure Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 07/62] secure_seq: downgrade to per-host timestamp offsets Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 08/62] bpf: improve verifier packet range checks Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 09/62] net/mlx5: Avoid dereferencing uninitialized pointer Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 10/62] l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 11/62] l2tp: purge socket queues in the .destruct() callback Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 12/62] net/packet: fix overflow in check for tp_frame_nr Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 13/62] net/packet: fix overflow in check for tp_reserve Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 14/62] openvswitch: Fix ovs_flow_key_update() Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 15/62] l2tp: take reference on sessions being dumped Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 16/62] l2tp: fix PPP pseudo-wire auto-loading Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 17/62] net: ipv4: fix multipath RTM_GETROUTE behavior when iif is given Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 18/62] sctp: listen on the sock only when its state is listening or closed Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 19/62] tcp: clear saved_syn in tcp_disconnect() Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 20/62] ipv6: Fix idev->addr_list corruption Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 21/62] net-timestamp: avoid use-after-free in ip_recv_error Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 22/62] net: vrf: Fix setting NLM_F_EXCL flag when adding l3mdev rule Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 23/62] sh_eth: unmap DMA buffers when freeing rings Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 24/62] ipv6: sr: fix out-of-bounds access in SRH validation Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 26/62] ipv6: sr: fix double free of skb after handling invalid SRH Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 27/62] ipv6: fix source routing Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 28/62] gso: Validate assumption of frag_list segementation Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 29/62] net: ipv6: RTF_PCPU should not be settable from userspace Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 30/62] netpoll: Check for skb->queue_mapping Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 31/62] ip6mr: fix notification device destruction Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 32/62] net/mlx5: Fix driver load bad flow when having fw initializing timeout Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 33/62] net/mlx5: E-Switch, Correctly deal with inline mode on ConnectX-5 Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 34/62] net/mlx5e: Fix small packet threshold Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 35/62] net/mlx5e: Fix ETHTOOL_GRXCLSRLALL handling Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 36/62] tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 37/62] tcp: mark skbs with SCM_TIMESTAMPING_OPT_STATS Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 38/62] macvlan: Fix device ref leak when purging bc_queue Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 39/62] net: ipv6: regenerate host route if moved to gc list Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 40/62] net: phy: fix auto-negotiation stall due to unavailable interrupt Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 41/62] ipv6: check skb->protocol before lookup for nexthop Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 42/62] tcp: memset ca_priv data to 0 properly Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 43/62] ipv6: check raw payload size correctly in ioctl Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 44/62] ALSA: oxfw: fix regression to handle Stanton SCS.1m/1d Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 45/62] ALSA: firewire-lib: fix inappropriate assignment between signed/unsigned type Greg Kroah-Hartman
2017-05-01 21:34 ` [PATCH 4.10 46/62] ALSA: seq: Dont break snd_use_lock_sync() loop by timeout Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 47/62] scsi: return correct blkprep status code in case scsi_init_io() fails Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 48/62] ARC: [plat-eznps] Fix build error Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 49/62] MIPS: KGDB: Use kernel context for sleeping threads Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 50/62] MIPS: cevt-r4k: Fix out-of-bounds array access Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 51/62] MIPS: Avoid BUG warning in arch_check_elf Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 52/62] p9_client_readdir() fix Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 53/62] ASoC: intel: Fix PM and non-atomic crash in bytcr drivers Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 56/62] nfsd4: minor NFSv2/v3 write decoding cleanup Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 58/62] ceph: fix recursion between ceph_set_acl() and __ceph_setattr() Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 59/62] macsec: avoid heap overflow in skb_to_sgvec Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 60/62] net: can: usb: gs_usb: Fix buffer on stack Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 61/62] cpu/hotplug: Serialize callback invocations proper Greg Kroah-Hartman
2017-05-01 21:35 ` [PATCH 4.10 62/62] ftrace/x86: Fix triple fault with graph tracing and suspend-to-ram Greg Kroah-Hartman
     [not found] ` <20170501212732.861897612@linuxfoundation.org>
2017-05-02  1:14   ` [PATCH 4.10 54/62] Input: i8042 - add Clevo P650RS to the i8042 reset list Ed Bordin
2017-05-02  1:22     ` Dmitry Torokhov
2017-05-02  2:16       ` Ed Bordin
     [not found] ` <5908121b.4778370a.18c89.ea22@mx.google.com>
2017-05-02 13:54   ` [PATCH 4.10 00/62] 4.10.14-stable review Shuah Khan
2017-05-02 17:05     ` Greg Kroah-Hartman
2017-05-02 17:05   ` Greg Kroah-Hartman
2017-05-02 17:36 ` Guenter Roeck
2017-05-02 18:33   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170501212730.907110052@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tom.hromatka@oracle.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.