[PATCH 1/4] pfnmap: fix 2.6.15-rc3 driver breakage

[PATCH 1/4] pfnmap: fix 2.6.15-rc3 driver breakage

[Hugh Dickins]

I've not tested any of them, but believe 2.6.15-rc3 will suffer from
premature freeing of pages in the case of the following drivers:

arch/ia64/kernel/perfmon.c
drivers/char/ftape/lowlevel/ftape-ctl.c
drivers/media/video/cpia.c
drivers/media/video/em28xx/em28xx-video.c
drivers/media/video/meye.c
drivers/media/video/planb.c
drivers/media/video/vino.c
drivers/media/video/zoran_driver.c
drivers/media/video/zr36120.c
drivers/usb/class/audio.c
drivers/usb/media/ov511.c
drivers/usb/media/pwc/pwc-if.c
drivers/usb/media/se401.c
drivers/usb/media/sn9c102_core.c
drivers/usb/media/stv680.c
drivers/usb/media/usbvideo.c
drivers/usb/media/vicam.c
drivers/usb/media/w9968cf.c
drivers/video/gbefb.c
drivers/video/sbuslib.c
net/packet/af_packet.c

About twenty drivers fill in their mmap vma by applying remap_pfn_range
repeatedly, many of them using vmalloc_to_pfn: vm_pgoff will match only
the last range or page mapped in, and the others will be considered
normal by vm_normal_page - thus although they were not counted in by
remap_pfn_range, they will be counted out by zap_pte_range, so freed
well before the driver has finished with them (and frees them again).

A temporary hack (checking for PageAnon and ZERO_PAGE) sure to disgust
Linus, but keep those drivers safe until the proper solution arrives.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
---

 mm/memory.c |   15 ++++++++++++++-
 1 files changed, 14 insertions(+), 1 deletion(-)

--- 2.6.15-rc3/mm/memory.c	2005-11-29 08:40:07.000000000 +0000
+++ linux/mm/memory.c	2005-11-29 15:59:34.000000000 +0000
@@ -372,6 +372,7 @@ void print_bad_pte(struct vm_area_struct
 struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr, pte_t pte)
 {
 	unsigned long pfn = pte_pfn(pte);
+	struct page *page;
 
 	if (vma->vm_flags & VM_PFNMAP) {
 		unsigned long off = (addr - vma->vm_start) >> PAGE_SHIFT;
@@ -399,7 +400,19 @@ struct page *vm_normal_page(struct vm_ar
 	 * The PAGE_ZERO() pages and various VDSO mappings can
 	 * cause them to exist.
 	 */
-	return pfn_to_page(pfn);
+	page = pfn_to_page(pfn);
+
+	/*
+	 * Temporary hack to avoid driver breakage.
+	 * About twenty drivers fill in their mmap vma by applying
+	 * remap_pfn_range repeatedly: vm_pgoff will match only the
+	 * last range mapped; so also check if page is COWed or ZERO.
+	 */
+	if ((vma->vm_flags & VM_PFNMAP) &&
+	    !PageAnon(page) && page != ZERO_PAGE(addr))
+		return NULL;
+
+	return page;
 }
 
 /*

[PATCH 2/4] pfnmap: cow_user_page needs mask

[Hugh Dickins]

The fault address to cow_user_page is not usually page aligned, so needs
to be masked in the unusual case when that copies via the user address.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
---

 mm/memory.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

--- 2.6.15-rc3/mm/memory.c	2005-11-29 08:40:07.000000000 +0000
+++ linux/mm/memory.c	2005-11-29 15:59:34.000000000 +0000
@@ -1300,7 +1313,8 @@ static inline void cow_user_page(struct 
 	 */
 	if (unlikely(!src)) {
 		void *kaddr = kmap_atomic(dst, KM_USER0);
-		unsigned long left = __copy_from_user_inatomic(kaddr, (void __user *)va, PAGE_SIZE);
+		unsigned long left = __copy_from_user_inatomic(kaddr,
+			(void __user *)(va & PAGE_MASK), PAGE_SIZE);
 		if (left)
 			memset(kaddr, 0, PAGE_SIZE);
 		kunmap_atomic(kaddr, KM_USER0);

[PATCH 3/4] pfnmap: remove src_page from do_wp_page

[Hugh Dickins]

Clean away do_wp_page's "src_page": cow_user_page makes it unnecessary.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
---

 mm/memory.c |    7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

--- 2.6.15-rc3/mm/memory.c	2005-11-29 08:40:07.000000000 +0000
+++ linux/mm/memory.c	2005-11-29 15:59:34.000000000 +0000
@@ -1332,12 +1346,11 @@ static int do_wp_page(struct mm_struct *
 		unsigned long address, pte_t *page_table, pmd_t *pmd,
 		spinlock_t *ptl, pte_t orig_pte)
 {
-	struct page *old_page, *src_page, *new_page;
+	struct page *old_page, *new_page;
 	pte_t entry;
 	int ret = VM_FAULT_MINOR;
 
 	old_page = vm_normal_page(vma, address, orig_pte);
-	src_page = old_page;
 	if (!old_page)
 		goto gotten;
 
@@ -1365,7 +1378,7 @@ gotten:
 
 	if (unlikely(anon_vma_prepare(vma)))
 		goto oom;
-	if (src_page == ZERO_PAGE(address)) {
+	if (old_page == ZERO_PAGE(address)) {
 		new_page = alloc_zeroed_user_highpage(vma, address);
 		if (!new_page)
 			goto oom;
@@ -1373,7 +1386,7 @@ gotten:
 		new_page = alloc_page_vma(GFP_HIGHUSER, vma, address);
 		if (!new_page)
 			goto oom;
-		cow_user_page(new_page, src_page, address);
+		cow_user_page(new_page, old_page, address);
 	}
 
 	/*

[PATCH 4/4] pfnmap: do_no_page BUG_ON again

[Hugh Dickins]

Use copy_user_highpage directly instead of cow_user_page in do_no_page:
in the immediately following page_cache_release, and elsewhere, it is
assuming that new_page is normal.  If any VM_PFNMAP driver can get to
do_no_page, it's just a BUG (but not in the case of do_anonymous_page).

Signed-off-by: Hugh Dickins <hugh@veritas.com>
---

 mm/memory.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletion(-)

--- 2.6.15-rc3/mm/memory.c	2005-11-29 08:40:07.000000000 +0000
+++ linux/mm/memory.c	2005-11-29 15:59:34.000000000 +0000
@@ -1909,6 +1922,8 @@ static int do_no_page(struct mm_struct *
 	int anon = 0;
 
 	pte_unmap(page_table);
+	BUG_ON(vma->vm_flags & VM_PFNMAP);
+
 	if (vma->vm_file) {
 		mapping = vma->vm_file->f_mapping;
 		sequence = mapping->truncate_count;
@@ -1941,7 +1956,7 @@ retry:
 		page = alloc_page_vma(GFP_HIGHUSER, vma, address);
 		if (!page)
 			goto oom;
-		cow_user_page(page, new_page, address);
+		copy_user_highpage(page, new_page, address);
 		page_cache_release(new_page);
 		new_page = page;
 		anon = 1;