Re: 2.6.10-rc1-mm3

[Ingo Molnar <mingo@elte.hu>]

* Ingo Molnar <mingo@elte.hu> wrote:

> > ------------[ cut here ]------------
> > kernel BUG at mm/memory.c:156!
> 
> > Process shmt04 (pid: 4854, threadinfo=dca51000 task=de374510)
> 
> reproducible here too, just running LTP's shmt04 directly triggers it
> immediately. Looks like there's interaction of 4-level pagetables with
> ipc/shm.c or mm/shmem.c.

due to the PML4 feature, the clear_page_tables() function changed to
clear_page_range(), changing its (first,size) argument to (first,last). 
Normally it's called with (0,TASK_SIZE) which normally is PML4-aligned,
but in the (relatively rare) do_munmap() use this is not the case. We
correctly calculate the range that could be cleared, but it's not
PML4_SIZE aligned.

The solution is to clip both 'first' and 'last' to PML4_SIZE boundary.
Since when we calculate 'first' we add at least +PML4_SIZE to the value,
it is safe to clip 'first'. It is obviously safe to clip 'last'.

The patch below implements this fix - it boots & works fine and shmt04
doesnt crash anymore. Andi, do you agree with this fix?

	Ingo

Signed-off-by: Ingo Molnar <mingo@elte.hu>

--- linux/mm/mmap.c.orig
+++ linux/mm/mmap.c
@@ -1545,7 +1545,7 @@ no_mmaps:
 	}
 	if (pml4_index(last) > start_pml4_index ||
 	    pgd_index(last) > start_pgd_index) {
-		clear_page_range(tlb, first, last);
+		clear_page_range(tlb, first & PML4_MASK, last & PML4_MASK);
 		flush_tlb_pgtables(mm, first & PML4_MASK, last & PML4_MASK);
 	}
 }