mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
	alan@lxorguk.ukuu.org.uk, KyongHo Cho <pullip.cho@samsung.com>,
	"Olav Haugan" <ohaugan@codeaurora.org>
Subject: [ 19/20] mm: fix faulty initialization in vmalloc_init()
Date: Thu, 14 Jun 2012 16:57:03 -0700	[thread overview]
Message-ID: <20120614235645.932553729@linuxfoundation.org> (raw)
In-Reply-To: <20120614235648.GA6552@kroah.com>

3.0-stable review patch.  If anyone has any objections, please let me know.

------------------

From: KyongHo <pullip.cho@samsung.com>

commit dbda591d920b4c7692725b13e3f68ecb251e9080 upstream.

The transfer of ->flags causes some of the static mapping virtual
addresses to be prematurely freed (before the mapping is removed) because
VM_LAZY_FREE gets "set" if tmp->flags has VM_IOREMAP set.  This might
cause subsequent vmalloc/ioremap calls to fail because it might allocate
one of the freed virtual address ranges that aren't unmapped.

va->flags has different types of flags from tmp->flags.  If a region with
VM_IOREMAP set is registered with vm_area_add_early(), it will be removed
by __purge_vmap_area_lazy().

Fix vmalloc_init() to correctly initialize vmap_area for the given
vm_struct.

Also initialise va->vm.  If it is not set, find_vm_area() for the early
vm regions will always fail.

Signed-off-by: KyongHo Cho <pullip.cho@samsung.com>
Cc: "Olav Haugan" <ohaugan@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/vmalloc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1174,9 +1174,10 @@ void __init vmalloc_init(void)
 	/* Import existing vmlist entries. */
 	for (tmp = vmlist; tmp; tmp = tmp->next) {
 		va = kzalloc(sizeof(struct vmap_area), GFP_NOWAIT);
-		va->flags = tmp->flags | VM_VM_AREA;
+		va->flags = VM_VM_AREA;
 		va->va_start = (unsigned long)tmp->addr;
 		va->va_end = va->va_start + tmp->size;
+		va->vm = tmp;
 		__insert_vmap_area(va);
 	}
 



  parent reply	other threads:[~2012-06-14 23:58 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-06-14 23:56 [ 00/20] 3.0.35-stable review Greg KH
2012-06-14 23:56 ` [ 01/20] char/agp: add another Ironlake host bridge Greg KH
2012-06-14 23:56 ` [ 02/20] btree: fix tree corruption in btree_get_prev() Greg KH
2012-06-14 23:56 ` [ 03/20] powerpc: Fix kernel panic during kernel module load Greg KH
2012-06-14 23:56 ` [ 04/20] crypto: aesni-intel - fix unaligned cbc decrypt for x86-32 Greg KH
2012-06-14 23:56 ` [ 05/20] mac80211: clean up remain-on-channel on interface stop Greg KH
2012-06-14 23:56 ` [ 06/20] cfg80211: fix interface combinations check Greg KH
2012-06-14 23:56 ` [ 07/20] net: sierra_net: device IDs for Aircard 320U++ Greg KH
2012-06-14 23:56 ` [ 08/20] can: c_can: fix "BUG! echo_skb is occupied!" during transmit Greg KH
2012-06-14 23:56 ` [ 09/20] can: c_can: fix an interrupt thrash issue with c_can driver Greg KH
2012-06-14 23:56 ` [ 10/20] can: c_can: fix race condition in c_can_open() Greg KH
2012-06-14 23:56 ` [ 11/20] hwmon: (fam15h_power) Increase output resolution Greg KH
2012-06-14 23:56 ` [ 12/20] acpi_video: fix leaking PCI references Greg KH
2012-06-14 23:56 ` [ 13/20] sched: Fix the relax_domain_level boot parameter Greg KH
2012-06-14 23:56 ` [ 14/20] iwlwifi: dont mess up the SCD when removing a key Greg KH
2012-06-14 23:56 ` [ 15/20] x86, MCE, AMD: Make APIC LVT thresholding interrupt optional Greg KH
2012-06-14 23:57 ` [ 16/20] fuse: fix stat call on 32 bit platforms Greg KH
2012-06-14 23:57 ` [ 17/20] e1000: save skb counts in TX to avoid cache misses Greg KH
2012-06-14 23:57 ` [ 18/20] mm/vmalloc.c: change void* into explict vm_struct* Greg KH
2012-06-14 23:57 ` Greg KH [this message]
2012-06-14 23:57 ` [ 20/20] hugetlb: fix resv_map leak in error path Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20120614235645.932553729@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ohaugan@codeaurora.org \
    --cc=pullip.cho@samsung.com \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

Powered by JetHome