* [PATCH] futexs: fix infinite loop in get_futex_key on huge page
@ 2009-07-10 23:13 Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Sonny Rao @ 2009-07-10 23:13 UTC (permalink / raw)
To: tglx
Cc: mingo, linux-kernel, linux-mm, sonnyrao, stable, anton, rajamony,
speight, mstephen, grimm, mikey
get_futex_key() can infinitely loop if it is called on a virtual address
that is within a huge page but not aligned to the beginning of that
page. The call to get_user_pages_fast will return the struct page for
a sub-page within the huge page and the check for page->mapping will
always fail.
The fix is to call compound_head on the page before checking that it's mapped.
Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@kernel.org
Index: linux-2.6.31-rc2/kernel/futex.c
===================================================================
--- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500
+++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500
@@ -247,6 +247,7 @@
if (err < 0)
return err;
+ page = compound_head(page);
lock_page(page);
if (!page->mapping) {
unlock_page(page);
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] futexs: fix infinite loop in get_futex_key on huge page
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
@ 2009-07-11 8:19 ` Ingo Molnar
2009-07-11 10:14 ` Thomas Gleixner
2009-07-11 8:22 ` [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() " tip-bot for Sonny Rao
2009-07-11 10:42 ` tip-bot for Sonny Rao
2 siblings, 1 reply; 5+ messages in thread
From: Ingo Molnar @ 2009-07-11 8:19 UTC (permalink / raw)
To: Sonny Rao
Cc: tglx, mingo, linux-kernel, linux-mm, stable, anton, rajamony,
speight, mstephen, grimm, mikey
* Sonny Rao <sonnyrao@us.ibm.com> wrote:
> get_futex_key() can infinitely loop if it is called on a virtual
> address that is within a huge page but not aligned to the
> beginning of that page. The call to get_user_pages_fast will
> return the struct page for a sub-page within the huge page and the
> check for page->mapping will always fail.
>
> The fix is to call compound_head on the page before checking that
> it's mapped.
>
> Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: stable@kernel.org
>
> Index: linux-2.6.31-rc2/kernel/futex.c
> ===================================================================
> --- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500
> +++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500
> @@ -247,6 +247,7 @@
> if (err < 0)
> return err;
>
> + page = compound_head(page);
> lock_page(page);
> if (!page->mapping) {
> unlock_page(page);
Nice catch! Applied it to tip:core/urgent - Thomas, do you agree
with the fix?
Ingo
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] futexs: fix infinite loop in get_futex_key on huge page
2009-07-11 8:19 ` Ingo Molnar
@ 2009-07-11 10:14 ` Thomas Gleixner
0 siblings, 0 replies; 5+ messages in thread
From: Thomas Gleixner @ 2009-07-11 10:14 UTC (permalink / raw)
To: Ingo Molnar
Cc: Sonny Rao, tglx, mingo, linux-kernel, linux-mm, stable, anton,
rajamony, speight, mstephen, grimm, mikey
On Sat, 11 Jul 2009, Ingo Molnar wrote:
>
> * Sonny Rao <sonnyrao@us.ibm.com> wrote:
>
> > get_futex_key() can infinitely loop if it is called on a virtual
> > address that is within a huge page but not aligned to the
> > beginning of that page. The call to get_user_pages_fast will
> > return the struct page for a sub-page within the huge page and the
> > check for page->mapping will always fail.
> >
> > The fix is to call compound_head on the page before checking that
> > it's mapped.
> >
> > Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
> > Cc: Ingo Molnar <mingo@redhat.com>
> > Cc: stable@kernel.org
> >
> > Index: linux-2.6.31-rc2/kernel/futex.c
> > ===================================================================
> > --- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500
> > +++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500
> > @@ -247,6 +247,7 @@
> > if (err < 0)
> > return err;
> >
> > + page = compound_head(page);
> > lock_page(page);
> > if (!page->mapping) {
> > unlock_page(page);
>
> Nice catch! Applied it to tip:core/urgent - Thomas, do you agree
> with the fix?
Acked-by-me.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() on huge page
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
@ 2009-07-11 8:22 ` tip-bot for Sonny Rao
2009-07-11 10:42 ` tip-bot for Sonny Rao
2 siblings, 0 replies; 5+ messages in thread
From: tip-bot for Sonny Rao @ 2009-07-11 8:22 UTC (permalink / raw)
To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, sonnyrao, tglx, mingo
Commit-ID: 7c8fa4f04ab956076605422d5ed37410893a8a73
Gitweb: http://git.kernel.org/tip/7c8fa4f04ab956076605422d5ed37410893a8a73
Author: Sonny Rao <sonnyrao@us.ibm.com>
AuthorDate: Fri, 10 Jul 2009 18:13:13 -0500
Committer: Ingo Molnar <mingo@elte.hu>
CommitDate: Sat, 11 Jul 2009 10:18:45 +0200
futexes: Fix infinite loop in get_futex_key() on huge page
get_futex_key() can infinitely loop if it is called on a
virtual address that is within a huge page but not aligned to
the beginning of that page. The call to get_user_pages_fast
will return the struct page for a sub-page within the huge page
and the check for page->mapping will always fail.
The fix is to call compound_head on the page before checking
that it's mapped.
Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
Cc: stable@kernel.org
Cc: anton@samba.org
Cc: rajamony@us.ibm.com
Cc: speight@us.ibm.com
Cc: mstephen@us.ibm.com
Cc: grimm@us.ibm.com
Cc: mikey@ozlabs.au.ibm.com
LKML-Reference: <20090710231313.GA23572@us.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
kernel/futex.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index 794c862..0672ff8 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -247,6 +247,7 @@ again:
if (err < 0)
return err;
+ page = compound_head(page);
lock_page(page);
if (!page->mapping) {
unlock_page(page);
^ permalink raw reply related [flat|nested] 5+ messages in thread* [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() on huge page
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
2009-07-11 8:22 ` [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() " tip-bot for Sonny Rao
@ 2009-07-11 10:42 ` tip-bot for Sonny Rao
2 siblings, 0 replies; 5+ messages in thread
From: tip-bot for Sonny Rao @ 2009-07-11 10:42 UTC (permalink / raw)
To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, sonnyrao, tglx, mingo
Commit-ID: ce2ae53b750abfaa012ce408e93da131a5b5649b
Gitweb: http://git.kernel.org/tip/ce2ae53b750abfaa012ce408e93da131a5b5649b
Author: Sonny Rao <sonnyrao@us.ibm.com>
AuthorDate: Fri, 10 Jul 2009 18:13:13 -0500
Committer: Ingo Molnar <mingo@elte.hu>
CommitDate: Sat, 11 Jul 2009 12:40:44 +0200
futexes: Fix infinite loop in get_futex_key() on huge page
get_futex_key() can infinitely loop if it is called on a
virtual address that is within a huge page but not aligned to
the beginning of that page. The call to get_user_pages_fast
will return the struct page for a sub-page within the huge page
and the check for page->mapping will always fail.
The fix is to call compound_head on the page before checking
that it's mapped.
Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@kernel.org
Cc: anton@samba.org
Cc: rajamony@us.ibm.com
Cc: speight@us.ibm.com
Cc: mstephen@us.ibm.com
Cc: grimm@us.ibm.com
Cc: mikey@ozlabs.au.ibm.com
LKML-Reference: <20090710231313.GA23572@us.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
kernel/futex.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index 794c862..0672ff8 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -247,6 +247,7 @@ again:
if (err < 0)
return err;
+ page = compound_head(page);
lock_page(page);
if (!page->mapping) {
unlock_page(page);
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2009-07-11 10:43 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-10 23:13 [PATCH] futexs: fix infinite loop in get_futex_key on huge page Sonny Rao
2009-07-11 8:19 ` Ingo Molnar
2009-07-11 10:14 ` Thomas Gleixner
2009-07-11 8:22 ` [tip:core/urgent] futexes: Fix infinite loop in get_futex_key() " tip-bot for Sonny Rao
2009-07-11 10:42 ` tip-bot for Sonny Rao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox