From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756829AbcB0WLc (ORCPT ); Sat, 27 Feb 2016 17:11:32 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58828 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756728AbcB0WLb (ORCPT ); Sat, 27 Feb 2016 17:11:31 -0500 Date: Sat, 27 Feb 2016 23:11:28 +0100 From: Oleg Nesterov To: Andy Lutomirski , Ingo Molnar Cc: Jiri Olsa , Peter Zijlstra , Pratyush Anand , linux-kernel@vger.kernel.org Subject: [PATCH tip/x86/asm] uprobes: __create_xol_area() must nullify xol_mapping.fault Message-ID: <20160227221128.GA29565@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org As Jiri pointed out, the recent commit f872f5400cc0 "mm: Add a vm_special_mapping.fault() method" breaks uprobes. __create_xol_area() doesn't initialize the new ->fault() method and this obviously leads to kernel crash when the application tries to execute the probed insn after bp hit. We probably want to add uprobes_special_mapping_fault(), this allows to turn xol_area->xol_mapping into a single instance of vm_special_mapping. But we need a simple fix, so lets change __create_xol() to nullify the new member as Jiri suggests. Reported-by: Jiri Olsa Suggested-by: Jiri Olsa Signed-off-by: Oleg Nesterov --- kernel/events/uprobes.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index 0167679..5f6ce93 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -1178,6 +1178,7 @@ static struct xol_area *__create_xol_area(unsigned long vaddr) goto free_area; area->xol_mapping.name = "[uprobes]"; + area->xol_mapping.fault = NULL; area->xol_mapping.pages = area->pages; area->pages[0] = alloc_page(GFP_HIGHUSER); if (!area->pages[0]) -- 2.5.0