[PATCH] Fix hugepage crash on failing mmap()

[PATCH] Fix hugepage crash on failing mmap()

[David Gibson]

Andrew/Linus, please apply:

This patch fixes a crash in the hugepage code.  unmap_hugepage_area()
was assuming that (due to prefault) PTEs must exist for all the area
in question.  However, this may not be the case, if mmap() encounters
an error before the prefault and calls unmap_region() to clean up any
partial mapping.

Depending on the hugepage configuration, this crash can be triggered
by an unpriveleged user.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

Index: working-2.6/mm/hugetlb.c
===================================================================
--- working-2.6.orig/mm/hugetlb.c	2005-08-05 18:47:10.000000000 +1000
+++ working-2.6/mm/hugetlb.c	2005-08-05 18:58:09.000000000 +1000
@@ -301,6 +301,7 @@
 {
 	struct mm_struct *mm = vma->vm_mm;
 	unsigned long address;
+	pte_t *ptep;
 	pte_t pte;
 	struct page *page;
 
@@ -309,9 +310,17 @@
 	BUG_ON(end & ~HPAGE_MASK);
 
 	for (address = start; address < end; address += HPAGE_SIZE) {
-		pte = huge_ptep_get_and_clear(mm, address, huge_pte_offset(mm, address));
+		ptep = huge_pte_offset(mm, address);
+		if (! ptep)
+			/* This can happen on truncate, or if an
+			 * mmap() is aborted due to an error before
+			 * the prefault */
+			continue;
+
+		pte = huge_ptep_get_and_clear(mm, address, ptep);
 		if (pte_none(pte))
 			continue;
+
 		page = pte_page(pte);
 		put_page(page);
 	}


-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/people/dgibson