[PATCH] include/asm-x86_64/pgtable.h pgd_offset_gate()

[PATCH] include/asm-x86_64/pgtable.h pgd_offset_gate()

[John Blackwood]

Hi Andi,

We noticed a problem on x86_64 platforms where a /proc read of the
vsyscall area (address 0xffffffffff600000) would cause the kernel to
oops in get_user_pages().

I believe that the fix is to pull in the include/asm-ia64/pgtable.h
changes for pgd_offset_gate() into the x86_64 pgtable.h header file.

This seems to fix the problem nicely for us.

The original ia64 patch was:

# ChangeSet
#   2004/07/28 23:01:30-07:00 davidm@napali.hpl.hp.com
#   [PATCH] Make get_user_pages() work again for ia64 gate area
#
#   Changeset
#
#     roland@redhat.com[torvalds]|ChangeSet|20040624165002|30880
#
#   inadvertently broke ia64 because the patch assumed that 
pgd_offset_k() is
#   just an optimization of pgd_offset(), which it is not.  This patch fixes
#   the problem by introducing pgd_offset_gate().  On architectures on which
#   the gate area lives in the user's address-space, this should be 
aliased to
#   pgd_offset() and on architectures on which the gate area lives in the
#   kernel-mapped segment, this should be aliased to pgd_offset_k().
#
#   This bug was found and tracked down by Peter Chubb.
#
#   Signed-off-by: <davidm@hpl.hp.com>
#   Signed-off-by: Andrew Morton <akpm@osdl.org>
#   Signed-off-by: Linus Torvalds <torvalds@osdl.org>


The changes to pgtable.h for x86_64 are below.

Thank you for your time and considerations.



diff -ru linux-2.6.9/include/asm-x86_64/pgtable.h 
linux/include/asm-x86_64/pgtable.h
--- linux-2.6.9/include/asm-x86_64/pgtable.h    2004-10-18 
17:54:40.000000000 -0400
+++ linux/include/asm-x86_64/pgtable.h  2004-12-10 16:00:30.434277001 -0500
@@ -340,6 +340,11 @@
         return __pgd_offset_k((pgd_t *)__va(addr), address);
  }

+/* Look up a pgd entry in the gate area.  On x86_64, the gate-area
+   resides in the kernel-mapped segment, hence we use pgd_offset_k()
+   here.  */
+#define pgd_offset_gate(mm, addr)      pgd_offset_k(addr)
+
  #define pgd_offset(mm, address) ((mm)->pgd+pgd_index(address))

  /* PMD  - Level 2 access */
@@ -442,6 +447,7 @@
  #define __HAVE_ARCH_PTEP_SET_WRPROTECT
  #define __HAVE_ARCH_PTEP_MKDIRTY
  #define __HAVE_ARCH_PTE_SAME
+#define __HAVE_ARCH_PGD_OFFSET_GATE
  #include <asm-generic/pgtable.h>

  #endif /* _X86_64_PGTABLE_H */

Re: [PATCH] include/asm-x86_64/pgtable.h pgd_offset_gate()

[John Blackwood]

Please ignore my previous posting.

It turns out that there is already a fix for this problem by Andi Kleen:

# ChangeSet
#   2004/11/15 19:53:40-08:00 ak@suse.de
#   [PATCH] x86-64: Fix get_user_pages access to vsyscall page
#
#   The current kernel oopses on x86-64 when gdb steps into the vsyscall 
page.
#   This patch fixes it.
#
#   I also removed the bogus NULL checks of *_offset and replaced them with
#   proper _none checks.  I made them BUGs because vsyscall pages should be
#   always mapped.
#
#   Signed-off-by: Andi Kleen <ak@suse.de>
#   Signed-off-by: Andrew Morton <akpm@osdl.org>
#   Signed-off-by: Linus Torvalds <torvalds@osdl.org>
#
# mm/memory.c
#   2004/11/15 19:29:06-08:00 ak@suse.de +7 -11
#   x86-64: Fix get_user_pages access to vsyscall page
#
diff -Nru a/mm/memory.c b/mm/memory.c
--- a/mm/memory.c       2004-12-14 05:20:10 -08:00
+++ b/mm/memory.c       2004-12-14 05:20:10 -08:00
@@ -739,19 +739,15 @@
                         pte_t *pte;
                         if (write) /* user gate pages are read-only */
                                 return i ? : -EFAULT;
-                       pgd = pgd_offset_gate(mm, pg);
-                       if (!pgd)
-                               return i ? : -EFAULT;
+                       if (pg > TASK_SIZE)
+                               pgd = pgd_offset_k(pg);
+                       else
+                               pgd = pgd_offset_gate(mm, pg);
+                       BUG_ON(pgd_none(*pgd));
                         pmd = pmd_offset(pgd, pg);
-                       if (!pmd)
-                               return i ? : -EFAULT;
+                       BUG_ON(pmd_none(*pmd));
                         pte = pte_offset_map(pmd, pg);
-                       if (!pte)
-                               return i ? : -EFAULT;
-                       if (!pte_present(*pte)) {
-                               pte_unmap(pte);
-                               return i ? : -EFAULT;
-                       }
+                       BUG_ON(pte_none(*pte));
                         if (pages) {
                                 pages[i] = pte_page(*pte);
                                 get_page(pages[i]);