iMX/i2som-imx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
db2426f86d44fc423aa36fd8b8302aa7155e161f
i2som-imx-linux/mm
History
Muchun Song 5126bdeaf9 mm/ksm: fix NULL pointer dereference when KSM zero page is enabled 
commit 56df70a63e upstream.

find_mergeable_vma() can return NULL.  In this case, it leads to a crash
when we access vm_mm(its offset is 0x40) later in write_protect_page.
And this case did happen on our server.  The following call trace is
captured in kernel 4.19 with the following patch applied and KSM zero
page enabled on our server.

  commit e86c59b1b1 ("mm/ksm: improve deduplication of zero pages with colouring")

So add a vma check to fix it.

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
  Oops: 0000 [#1] SMP NOPTI
  CPU: 9 PID: 510 Comm: ksmd Kdump: loaded Tainted: G OE 4.19.36.bsk.9-amd64 #4.19.36.bsk.9
  RIP: try_to_merge_one_page+0xc7/0x760
  Code: 24 58 65 48 33 34 25 28 00 00 00 89 e8 0f 85 a3 06 00 00 48 83 c4
        60 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 8b 46 08 a8 01 75 b8 <49>
        8b 44 24 40 4c 8d 7c 24 20 b9 07 00 00 00 4c 89 e6 4c 89 ff 48
  RSP: 0018:ffffadbdd9fffdb0 EFLAGS: 00010246
  RAX: ffffda83ffd4be08 RBX: ffffda83ffd4be40 RCX: 0000002c6e800000
  RDX: 0000000000000000 RSI: ffffda83ffd4be40 RDI: 0000000000000000
  RBP: ffffa11939f02ec0 R08: 0000000094e1a447 R09: 00000000abe76577
  R10: 0000000000000962 R11: 0000000000004e6a R12: 0000000000000000
  R13: ffffda83b1e06380 R14: ffffa18f31f072c0 R15: ffffda83ffd4be40
  FS: 0000000000000000(0000) GS:ffffa0da43b80000(0000) knlGS:0000000000000000
  CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000040 CR3: 0000002c77c0a003 CR4: 00000000007626e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  PKRU: 55555554
  Call Trace:
    ksm_scan_thread+0x115e/0x1960
    kthread+0xf5/0x130
    ret_from_fork+0x1f/0x30

[songmuchun@bytedance.com: if the vma is out of date, just exit]
  Link: http://lkml.kernel.org/r/20200416025034.29780-1-songmuchun@bytedance.com
[akpm@linux-foundation.org: add the conventional braces, replace /** with /*]
Fixes: e86c59b1b1 ("mm/ksm: improve deduplication of zero pages with colouring")
Co-developed-by: Xiongchun Duan <duanxiongchun@bytedance.com>
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Yang Shi <yang.shi@linux.alibaba.com>
Cc: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
Cc: Markus Elfring <Markus.Elfring@web.de>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200416025034.29780-1-songmuchun@bytedance.com
Link: http://lkml.kernel.org/r/20200414132905.83819-1-songmuchun@bytedance.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-29 16:33:15 +02:00
..
kasan
mm: introduce compound_nr()
2019-09-24 15:54:08 -07:00
backing-dev.c
memcg: fix a crash in wb_workfn when a device disappears
2020-02-11 04:35:11 -08:00
balloon_compaction.c
mm/balloon_compaction: suppress allocation warnings
2019-09-04 07:42:01 -04:00
cleancache.c
…
cma_debug.c
…
cma.c
…
cma.h
…
compaction.c
mm, compaction: fix wrong pfn handling in __reset_isolation_pfn()
2019-10-14 15:04:01 -07:00
debug_page_ref.c
…
debug.c
mm/debug.c: always print flags in dump_page()
2020-03-05 16:43:51 +01:00
dmapool.c
…
early_ioremap.c
…
fadvise.c
fs: Export generic_fadvise()
2019-08-30 22:43:58 -07:00
failslab.c
…
filemap.c
mm: drop mmap_sem before calling balance_dirty_pages() in write fault
2020-01-09 10:19:55 +01:00
frame_vector.c
mm: untag user pointers in get_vaddr_frames
2019-09-25 17:51:41 -07:00
frontswap.c
…
gup_benchmark.c
mm/gup: fix memory leak in __gup_benchmark_ioctl
2020-01-09 10:20:00 +01:00
gup.c
mm/gup: allow FOLL_FORCE for get_user_pages_fast()
2020-03-05 16:43:51 +01:00
highmem.c
…
hmm.c
pagewalk: separate function pointers from iterator data
2019-09-07 04:28:04 -03:00
huge_memory.c
mm: fix possible PMD dirty bit lost in set_pmd_migration_entry()
2020-03-12 13:00:19 +01:00
hugetlb_cgroup.c
mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup()
2019-11-15 18:34:00 -08:00
hugetlb.c
mm/hugetlb: fix a addressing exception caused by huge_pte_offset
2020-04-29 16:33:14 +02:00
hwpoison-inject.c
…
init-mm.c
mm/init-mm.c: include <linux/mman.h> for vm_committed_as_batch
2019-10-19 06:32:32 -04:00
internal.h
mm: drop mmap_sem before calling balance_dirty_pages() in write fault
2020-01-09 10:19:55 +01:00
interval_tree.c
…
Kconfig
mm,thp: add read-only THP support for (non-shmem) FS
2019-09-24 15:54:11 -07:00
Kconfig.debug
mm, page_owner, debug_pagealloc: save and dump freeing stack trace
2019-09-24 15:54:08 -07:00
khugepaged.c
mm,thp: recheck each page before collapsing file THP
2019-11-15 18:34:00 -08:00
kmemleak-test.c
…
kmemleak.c
kmemleak: Do not corrupt the object_list during clean-up
2019-10-14 08:56:16 -07:00
ksm.c
mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
2020-04-29 16:33:15 +02:00
list_lru.c
…
maccess.c
uaccess: Add non-pagefault user-space write function
2020-01-17 19:48:40 +01:00
madvise.c
mm: do not allow MADV_PAGEOUT for CoW pages
2020-03-25 08:25:57 +01:00
Makefile
mm: silence -Woverride-init/initializer-overrides
2019-09-24 15:54:10 -07:00
memblock.c
mm: memblock: do not enforce current limit for memblock_phys* family
2019-10-19 06:32:32 -04:00
memcontrol.c
mm, memcg: do not high throttle allocators based on wraparound
2020-04-17 10:50:17 +02:00
memfd.c
mm: page cache: store only head pages in i_pages
2019-09-24 15:54:08 -07:00
memory_hotplug.c
mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled
2020-03-12 13:00:19 +01:00
memory-failure.c
mm/memory-failure.c: don't access uninitialized memmaps in memory_failure()
2019-10-19 06:32:31 -04:00
memory.c
mm: drop mmap_sem before calling balance_dirty_pages() in write fault
2020-01-09 10:19:55 +01:00
mempolicy.c
mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
2020-04-08 09:08:47 +02:00
mempool.c
…
memremap.c
mm/memory_hotplug: shrink zones when offlining memory
2020-01-09 10:19:56 +01:00
memtest.c
…
migrate.c
mm: move_pages: report the number of non-attempted pages
2020-02-11 04:35:13 -08:00
mincore.c
mm: untag user pointers passed to memory syscalls
2019-09-25 17:51:41 -07:00
mlock.c
mm: untag user pointers passed to memory syscalls
2019-09-25 17:51:41 -07:00
mm_init.c
…
mmap.c
mm: Avoid creating virtual address aliases in brk()/mmap()/mremap()
2020-02-28 17:22:21 +01:00
mmu_context.c
…
mmu_gather.c
mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush
2020-02-11 04:35:42 -08:00
mmu_notifier.c
mm/mmu_notifiers: use the right return code for WARN_ON
2019-11-06 08:47:50 -08:00
mmzone.c
…
mprotect.c
mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
2020-03-12 13:00:19 +01:00
mremap.c
mm: Avoid creating virtual address aliases in brk()/mmap()/mremap()
2020-02-28 17:22:21 +01:00
msync.c
mm: untag user pointers passed to memory syscalls
2019-09-25 17:51:41 -07:00
nommu.c
x86/mm: split vmalloc_sync_all()
2020-03-25 08:25:58 +01:00
oom_kill.c
mm/oom: fix pgtables units mismatch in Killed process message
2020-01-09 10:19:57 +01:00
page_alloc.c
mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section
2020-02-11 04:35:42 -08:00
page_counter.c
…
page_ext.c
mm, page_owner: fix off-by-one error in __set_page_owner_handle()
2019-10-14 15:04:00 -07:00
page_idle.c
…
page_io.c
mm/page_io.c: do not free shared swap slots
2019-11-15 18:34:00 -08:00
page_isolation.c
…
page_owner.c
mm/page_owner: don't access uninitialized memmaps when reading /proc/pagetypeinfo
2019-10-19 06:32:31 -04:00
page_poison.c
mm/page_poison.c: fix a typo in a comment
2019-09-24 15:54:08 -07:00
page_vma_mapped.c
mm: introduce page_size()
2019-09-24 15:54:08 -07:00
page-writeback.c
mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
2020-01-23 08:22:41 +01:00
pagewalk.c
pagewalk: use lockdep_assert_held for locking validation
2019-09-07 04:28:04 -03:00
percpu-internal.h
…
percpu-km.c
…
percpu-stats.c
…
percpu-vm.c
…
percpu.c
percpu: Use struct_size() helper
2019-09-04 13:40:49 -07:00
pgtable-generic.c
…
process_vm_access.c
…
readahead.c
…
rmap.c
mm: include <linux/huge_mm.h> for is_vma_temporary_stack
2019-10-19 06:32:32 -04:00
rodata_test.c
…
shmem.c
mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment
2020-01-23 08:22:39 +01:00
shuffle.c
mm: fix -Wmissing-prototypes warnings
2019-10-07 15:47:19 -07:00
shuffle.h
…
slab_common.c
mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid
2020-01-23 08:22:39 +01:00
slab.c
mm, debug_pagealloc: don't rely on static keys too early
2020-01-23 08:22:40 +01:00
slab.h
mm: slab: make page_cgroup_ino() to recognize non-compound slab pages properly
2019-11-06 08:47:50 -08:00
slob.c
mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)
2019-10-07 15:47:20 -07:00
slub.c
slub: improve bit diffusion for freelist ptr obfuscation
2020-04-13 10:48:07 +02:00
sparse-vmemmap.c
…
sparse.c
mm/sparse: fix kernel crash with pfn_section_valid check
2020-04-01 11:02:03 +02:00
swap_cgroup.c
…
swap_slots.c
…
swap_state.c
mm: page cache: store only head pages in i_pages
2019-09-24 15:54:08 -07:00
swap.c
mm: introduce MADV_COLD
2019-09-25 17:51:41 -07:00
swapfile.c
mm/swapfile.c: move inode_lock out of claim_swapfile
2020-04-01 11:02:02 +02:00
truncate.c
mm/thp: allow dropping THP from page cache
2019-10-19 06:32:33 -04:00
usercopy.c
usercopy: Avoid HIGHMEM pfn warning
2019-09-17 15:20:17 -07:00
userfaultfd.c
…
util.c
arm64, mm: make randomization selected by generic topdown mmap layout
2019-09-24 15:54:11 -07:00
vmacache.c
…
vmalloc.c
vmalloc: fix remap_vmalloc_range() bounds checks
2020-04-29 16:33:14 +02:00
vmpressure.c
mm/vmpressure.c: fix a signedness bug in vmpressure_register_event()
2019-10-07 15:47:19 -07:00
vmscan.c
mm/vmscan.c: don't round up scan size for online memory cgroup
2020-02-28 17:22:20 +01:00
vmstat.c
mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo
2019-11-06 08:47:50 -08:00
workingset.c
…
z3fold.c
mm/z3fold.c: claim page in the beginning of free
2019-10-07 15:47:19 -07:00
zbud.c
…
zpool.c
zpool: add malloc_support_movable to zpool_driver
2019-09-24 15:54:12 -07:00
zsmalloc.c
mm/zsmalloc.c: fix the migrated zspage statistics.
2020-01-09 10:19:56 +01:00
zswap.c
zswap: do not map same object twice
2019-09-24 15:54:12 -07:00