[PATCH] Fix OOPS in mmap_region() when merging adjacent VM_LOCKED file segments

Lee Schermerhorn
2009-01-29T20:03:42Z

Against: 2.6.28.2

We see a:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
IP: [<ffffffff80336805>] __downgrade_write+0x43/0xb4
:
Call Trace:
[<ffffffff80284dec>] mlock_vma_pages_range+0x53/0xc3
[<ffffffff80287021>] mmap_region+0x389/0x471
[<ffffffff802876b5>] do_mmap_pgoff+0x308/0x36d
[<ffffffff802100a8>] sys_mmap+0x8b/0x110
[<ffffffff8020bc8b>] system_call_fastpath+0x16/0x1b

when mmap_region() merges two segments of a file mmap()ed with
MAP_LOCKED [VM_LOCKED].

This patch provides a simplistic fix, suitable, I hope, for -stable.

Pass the merged vma to mlock_vma_pages_range().

Tested with: http://free.linux.hp.com/~lts/Tests/mmap_lock.c

I'll attempt a rework of mlock_vma_pages_range(), et al, to
eliminate the 'vma' arg for 29-rc?.

Signed-off-by: Lee Schermerhorn <lee.schermerhorn@hp.com>

mm/mmap.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)

Index: linux-2.6.28.2/mm/mmap.c
===================================================================
--- linux-2.6.28.2.orig/mm/mmap.c 2009-01-29 11:34:08.000000000 -0500
+++ linux-2.6.28.2/mm/mmap.c 2009-01-29 12:22:14.000000000 -0500
@@ -1094,7 +1094,7 @@ unsigned long mmap_region(struct file *f
int accountable)
{
struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma, *prev;
+ struct vm_area_struct *vma, *prev, *merged = NULL;
int correct_wcount = 0;
int error;
struct rb_node **rb_link, *rb_parent;
@@ -1207,14 +1207,19 @@ munmap_back:
if (vma_wants_writenotify(vma))
vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);

- if (file && vma_merge(mm, prev, addr, vma->vm_end,
- vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {
- mpol_put(vma_policy(vma));
- kmem_cache_free(vm_area_cachep, vma);
- fput(file);
- if (vm_flags & VM_EXECUTABLE)
- removed_exe_file_vma(mm);
- } else {
+ if (file) {
+ merged = vma_merge(mm, prev, addr, vma->vm_end, vma->vm_flags,
+ NULL, file, pgoff, vma_policy(vma));
+ if (merged) {
+ mpol_put(vma_policy(vma));
+ kmem_cache_free(vm_area_cachep, vma);
+ fput(file);
+ if (vm_flags & VM_EXECUTABLE)
+ removed_exe_file_vma(mm);
+ vma = merged; /* for mlock_vma_pages_range() */
+ }
+ }
+ if (!merged) {
vma_link(mm, vma, prev, rb_link, rb_parent);
file = vma->vm_file;
}