* [PATCH] futexs: fix infinite loop in get_futex_key on huge page
@ 2009-07-10 23:13 Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Sonny Rao @ 2009-07-10 23:13 UTC (permalink / raw)
To: tglx
Cc: mingo, linux-kernel, linux-mm, sonnyrao, stable, anton, rajamony,
speight, mstephen, grimm, mikey
get_futex_key() can infinitely loop if it is called on a virtual address
that is within a huge page but not aligned to the beginning of that
page. The call to get_user_pages_fast will return the struct page for
a sub-page within the huge page and the check for page->mapping will
always fail.
The fix is to call compound_head on the page before checking that it's mapped.
Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@kernel.org
Index: linux-2.6.31-rc2/kernel/futex.c
===================================================================
--- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500
+++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500
@@ -247,6 +247,7 @@
if (err < 0)
return err;
+ page = compound_head(page);
lock_page(page);
if (!page->mapping) {
unlock_page(page);
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] futexs: fix infinite loop in get_futex_key on huge page
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
@ 2009-07-11 8:19 ` Ingo Molnar
2009-07-11 10:14 ` Thomas Gleixner
2009-07-11 8:22 ` [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() " tip-bot for Sonny Rao
2009-07-11 10:42 ` tip-bot for Sonny Rao
2 siblings, 1 reply; 5+ messages in thread
From: Ingo Molnar @ 2009-07-11 8:19 UTC (permalink / raw)
To: Sonny Rao
Cc: tglx, mingo, linux-kernel, linux-mm, stable, anton, rajamony,
speight, mstephen, grimm, mikey
* Sonny Rao <sonnyrao@us.ibm.com> wrote:
> get_futex_key() can infinitely loop if it is called on a virtual
> address that is within a huge page but not aligned to the
> beginning of that page. The call to get_user_pages_fast will
> return the struct page for a sub-page within the huge page and the
> check for page->mapping will always fail.
>
> The fix is to call compound_head on the page before checking that
> it's mapped.
>
> Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: stable@kernel.org
>
> Index: linux-2.6.31-rc2/kernel/futex.c
> ===================================================================
> --- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500
> +++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500
> @@ -247,6 +247,7 @@
> if (err < 0)
> return err;
>
> + page = compound_head(page);
> lock_page(page);
> if (!page->mapping) {
> unlock_page(page);
Nice catch! Applied it to tip:core/urgent - Thomas, do you agree
with the fix?
Ingo
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] futexs: fix infinite loop in get_futex_key on huge page
2009-07-11 8:19 ` Ingo Molnar
@ 2009-07-11 10:14 ` Thomas Gleixner
0 siblings, 0 replies; 5+ messages in thread
From: Thomas Gleixner @ 2009-07-11 10:14 UTC (permalink / raw)
To: Ingo Molnar
Cc: Sonny Rao, tglx, mingo, linux-kernel, linux-mm, stable, anton,
rajamony, speight, mstephen, grimm, mikey
On Sat, 11 Jul 2009, Ingo Molnar wrote:
>
> * Sonny Rao <sonnyrao@us.ibm.com> wrote:
>
> > get_futex_key() can infinitely loop if it is called on a virtual
> > address that is within a huge page but not aligned to the
> > beginning of that page. The call to get_user_pages_fast will
> > return the struct page for a sub-page within the huge page and the
> > check for page->mapping will always fail.
> >
> > The fix is to call compound_head on the page before checking that
> > it's mapped.
> >
> > Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
> > Cc: Ingo Molnar <mingo@redhat.com>
> > Cc: stable@kernel.org
> >
> > Index: linux-2.6.31-rc2/kernel/futex.c
> > ===================================================================
> > --- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500
> > +++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500
> > @@ -247,6 +247,7 @@
> > if (err < 0)
> > return err;
> >
> > + page = compound_head(page);
> > lock_page(page);
> > if (!page->mapping) {
> > unlock_page(page);
>
> Nice catch! Applied it to tip:core/urgent - Thomas, do you agree
> with the fix?
Acked-by-me.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() on huge page
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
@ 2009-07-11 8:22 ` tip-bot for Sonny Rao
2009-07-11 10:42 ` tip-bot for Sonny Rao
2 siblings, 0 replies; 5+ messages in thread
From: tip-bot for Sonny Rao @ 2009-07-11 8:22 UTC (permalink / raw)
To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, sonnyrao, tglx, mingo
Commit-ID: 7c8fa4f04ab956076605422d5ed37410893a8a73
Gitweb: http://git.kernel.org/tip/7c8fa4f04ab956076605422d5ed37410893a8a73
Author: Sonny Rao <sonnyrao@us.ibm.com>
AuthorDate: Fri, 10 Jul 2009 18:13:13 -0500
Committer: Ingo Molnar <mingo@elte.hu>
CommitDate: Sat, 11 Jul 2009 10:18:45 +0200
futexes: Fix infinite loop in get_futex_key() on huge page
get_futex_key() can infinitely loop if it is called on a
virtual address that is within a huge page but not aligned to
the beginning of that page. The call to get_user_pages_fast
will return the struct page for a sub-page within the huge page
and the check for page->mapping will always fail.
The fix is to call compound_head on the page before checking
that it's mapped.
Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
Cc: stable@kernel.org
Cc: anton@samba.org
Cc: rajamony@us.ibm.com
Cc: speight@us.ibm.com
Cc: mstephen@us.ibm.com
Cc: grimm@us.ibm.com
Cc: mikey@ozlabs.au.ibm.com
LKML-Reference: <20090710231313.GA23572@us.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
kernel/futex.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index 794c862..0672ff8 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -247,6 +247,7 @@ again:
if (err < 0)
return err;
+ page = compound_head(page);
lock_page(page);
if (!page->mapping) {
unlock_page(page);
^ permalink raw reply related [flat|nested] 5+ messages in thread* [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() on huge page
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
2009-07-11 8:22 ` [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() " tip-bot for Sonny Rao
@ 2009-07-11 10:42 ` tip-bot for Sonny Rao
2 siblings, 0 replies; 5+ messages in thread
From: tip-bot for Sonny Rao @ 2009-07-11 10:42 UTC (permalink / raw)
To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, sonnyrao, tglx, mingo
Commit-ID: ce2ae53b750abfaa012ce408e93da131a5b5649b
Gitweb: http://git.kernel.org/tip/ce2ae53b750abfaa012ce408e93da131a5b5649b
Author: Sonny Rao <sonnyrao@us.ibm.com>
AuthorDate: Fri, 10 Jul 2009 18:13:13 -0500
Committer: Ingo Molnar <mingo@elte.hu>
CommitDate: Sat, 11 Jul 2009 12:40:44 +0200
futexes: Fix infinite loop in get_futex_key() on huge page
get_futex_key() can infinitely loop if it is called on a
virtual address that is within a huge page but not aligned to
the beginning of that page. The call to get_user_pages_fast
will return the struct page for a sub-page within the huge page
and the check for page->mapping will always fail.
The fix is to call compound_head on the page before checking
that it's mapped.
Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@kernel.org
Cc: anton@samba.org
Cc: rajamony@us.ibm.com
Cc: speight@us.ibm.com
Cc: mstephen@us.ibm.com
Cc: grimm@us.ibm.com
Cc: mikey@ozlabs.au.ibm.com
LKML-Reference: <20090710231313.GA23572@us.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
kernel/futex.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index 794c862..0672ff8 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -247,6 +247,7 @@ again:
if (err < 0)
return err;
+ page = compound_head(page);
lock_page(page);
if (!page->mapping) {
unlock_page(page);
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2009-07-11 10:43 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
2009-07-11 10:14 ` Thomas Gleixner
2009-07-11 8:22 ` [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() " tip-bot for Sonny Rao
2009-07-11 10:42 ` tip-bot for Sonny Rao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.