mm: do_shared_fault: fix potential NULL pointer dereference

aet00 · sfrothwell · commit 6bb093a3ed46 · 2014-03-06T11:01:37.000+11:00
[ 232.869443] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [ 232.870230] IP: [<mm/page-writeback.c:1612>] balance_dirty_pages_ratelimited+0x1e/0x150 [ 232.870230] PGD 586e1d067 PUD 586e1e067 PMD 0 [ 232.870230] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 232.870230] Dumping ftrace buffer: [ 232.870230] (ftrace buffer empty) [ 232.870230] Modules linked in: [ 232.870230] CPU: 36 PID: 9707 Comm: trinity-c36 Tainted: G W 3.14.0-rc4-next-20140225-sasha-00010-ga117461 torvalds#42 [ 232.870230] task: ffff880586dfb000 ti: ffff880586e34000 task.ti: ffff880586e34000 [ 232.870230] RIP: 0010:[<mm/page-writeback.c:1612>] [<mm/page-writeback.c:1612>] balance_dirty_pages_ratelimited+0x1e/0x150 [ 232.870230] RSP: 0000:ffff880586e35c58 EFLAGS: 00010282 [ 232.870230] RAX: 0000000000000000 RBX: ffff880582831361 RCX: 0000000000000007 [ 232.870230] RDX: 0000000000000007 RSI: ffff880586dfbcc0 RDI: ffff880582831361 [ 232.870230] RBP: ffff880586e35c78 R08: 0000000000000000 R09: 0000000000000000 [ 232.870230] R10: 0000000000000001 R11: 0000000000000001 R12: 00007f58007ee000 [ 232.870230] R13: ffff880c8d6d4f70 R14: 0000000000000200 R15: ffff880c8dcce710 [ 232.870230] FS: 00007f58018bb700(0000) GS:ffff880c8e800000(0000) knlGS:0000000000000000 [ 232.870230] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 232.870230] CR2: 0000000000000020 CR3: 0000000586e1c000 CR4: 00000000000006e0 [ 232.870230] Stack: [ 232.870230] ffff880586e35c78 ffff880586e33400 00007f58007ee000 ffff880c8d6d4f70 [ 232.870230] ffff880586e35cd8 ffffffff8127d241 0000000000000001 0000000000000001 [ 232.870230] 0000000000000000 ffffea0032337080 0000000080000000 ffff880586e33400 [ 232.870230] Call Trace: [ 232.870230] [<mm/memory.c:3467>] do_shared_fault+0x1a1/0x1f0 [ 232.870230] [<mm/memory.c:3487>] handle_pte_fault+0xc8/0x230 [ 232.870230] [<arch/x86/include/asm/preempt.h:98>] ? delay_tsc+0xea/0x110 [ 232.870230] [<mm/memory.c:3770>] __handle_mm_fault+0x36e/0x3a0 [ 232.870230] [<include/linux/rcupdate.h:829>] ? rcu_read_unlock+0x5d/0x60 [ 232.870230] [<include/linux/memcontrol.h:148>] handle_mm_fault+0x10b/0x1b0 [ 232.870230] [<arch/x86/mm/fault.c:1147>] ? __do_page_fault+0x2e2/0x590 [ 232.870230] [<arch/x86/mm/fault.c:1214>] __do_page_fault+0x551/0x590 [ 232.870230] [<kernel/sched/cputime.c:681>] ? vtime_account_user+0x91/0xa0 [ 232.870230] [<arch/x86/include/asm/atomic.h:26>] ? context_tracking_user_exit+0xa8/0x1c0 [ 232.870230] [<arch/x86/include/asm/preempt.h:98>] ? _raw_spin_unlock+0x30/0x50 [ 232.870230] [<kernel/sched/cputime.c:681>] ? vtime_account_user+0x91/0xa0 [ 232.870230] [<arch/x86/include/asm/atomic.h:26>] ? context_tracking_user_exit+0xa8/0x1c0 [ 232.870230] [<arch/x86/include/asm/atomic.h:26>] do_page_fault+0x3d/0x70 [ 232.870230] [<arch/x86/kernel/kvm.c:263>] do_async_page_fault+0x35/0x100 [ 232.870230] [<arch/x86/kernel/entry_64.S:1496>] async_page_fault+0x28/0x30 [ 232.870230] Code: 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 48 89 fb 48 8b 87 50 01 00 00 <f6> 40 20 01 0f 85 18 01 00 00 65 48 8b 14 25 40 da 00 00 44 8b [ 232.870230] RIP [<mm/page-writeback.c:1612>] balance_dirty_pages_ratelimited+0x1e/0x150 [ 232.870230] RSP <ffff880586e35c58> [ 232.870230] CR2: 0000000000000020 See: https://lkml.org/lkml/2014/2/25/463 This bug was first introduced by commit: 'mm: introduce do_shared_fault() and drop do_fault()'(3a379a6) The root cause is 'fault_page->mapping' might be set to NULL just after the if condition and pass down to 'balance_dirty_pages_ratelimited()'. This patch fix this issue by use a local variable just as before. Signed-off-by: Bob Liu <bob.liu@oracle.com> Reported-by: Sasha Levin <sasha.levin@oracle.com> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Rik van Riel <riel@redhat.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Matthew Wilcox <matthew.r.wilcox@intel.com> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
diff --git a/mm/memory.c b/mm/memory.c
@@ -3415,6 +3415,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 		pgoff_t pgoff, unsigned int flags, pte_t orig_pte)
 {
 	struct page *fault_page;
+	struct address_space *mapping;
 	spinlock_t *ptl;
 	pte_t entry, *pte;
 	int dirtied = 0;
@@ -3475,13 +3476,14 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 
 	if (set_page_dirty(fault_page))
 		dirtied = 1;
+	mapping = fault_page->mapping;
 	unlock_page(fault_page);
-	if ((dirtied || vma->vm_ops->page_mkwrite) && fault_page->mapping) {
+	if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {
 		/*
 		 * Some device drivers do not set page.mapping but still
 		 * dirty their pages
 		 */
-		balance_dirty_pages_ratelimited(fault_page->mapping);
+		balance_dirty_pages_ratelimited(mapping);
 	}
 
 	/* file_update_time outside page_lock */
