failure in /mm/memory.c

failure in /mm/memory.c

[christophpfister]

hello

i found a failure in function remap_pte_range in memory.c

static inline void remap_pte_range(...)
{
unsigned long end;
unsigned long pfn;
address &= ~PMD_MASK;
end = address + size;
if (end > PMD_SIZE)
    end = PMD_SIZE;
pfn = phys_addr >> PAGE_SHIFT;
do {
    BUG_ON(!pte_none(*pte));
    if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn))) *****
      set_pte(pte, pfn_pte(pfn, prot));
    address += PAGE_SIZE;
    pfn++;
    pte++;
    } while (address && (address < end));
}

by ****

the condition is wrong, because it just maps the page, if it's invalid or
reserved

correct: if (!(pfn_valid(pfn) || PageReserved(pfn_to_page(pfn))))

(it doesn't seems to be used, otherwise there must be bugs)

Yours sincerely,

Christoph Pfister

Re: failure in /mm/memory.c

[William Lee Irwin III]

On Sat, Oct 16, 2004 at 12:32:35PM +0100, christophpfister@bluemail.ch wrote:
> i found a failure in function remap_pte_range in memory.c
> static inline void remap_pte_range(...)
> {
> unsigned long end;
> unsigned long pfn;
> address &= ~PMD_MASK;
> end = address + size;
> if (end > PMD_SIZE)
>     end = PMD_SIZE;
> pfn = phys_addr >> PAGE_SHIFT;
> do {
>     BUG_ON(!pte_none(*pte));
>     if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn))) *****
>       set_pte(pte, pfn_pte(pfn, prot));
>     address += PAGE_SIZE;
>     pfn++;
>     pte++;
>     } while (address && (address < end));
> }

Well, there are issues...

On Sat, Oct 16, 2004 at 12:32:35PM +0100, christophpfister@bluemail.ch wrote:
> by ****
> the condition is wrong, because it just maps the page, if it's invalid or
> reserved
> correct: if (!(pfn_valid(pfn) || PageReserved(pfn_to_page(pfn))))
> (it doesn't seems to be used, otherwise there must be bugs)

This isn't one of them. De Morgan teach us that what you wrote is just
	!pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn))
which would evaluate pfn_to_page() on an invalid pfn, and so nonsensical.


-- wli

Re: failure in /mm/memory.c

[Alan Cox]

On Sad, 2004-10-16 at 13:09, William Lee Irwin III wrote:
> On Sat, Oct 16, 2004 at 12:32:35PM +0100, christophpfister@bluemail.ch wrote:
> > i found a failure in function remap_pte_range in memory.c

I think the bug is in the comment not the code !

Re: failure in /mm/memory.c

[William Lee Irwin III]

On Sat, Oct 16, 2004 at 12:32:35PM +0100, christophpfister@bluemail.ch wrote:
>>> i found a failure in function remap_pte_range in memory.c

On Sad, 2004-10-16 at 13:09, William Lee Irwin III wrote:
[...]

On Sun, Oct 17, 2004 at 03:33:39AM +0100, Alan Cox wrote:
> I think the bug is in the comment not the code !

I suppose the comment is a bit off, sure. I'll send an update atop the
remap_pfn_range() patch series akpm has in -mm to correct it.


-- wli