Hugh Dickins b38af4721f x86,mm: fix pte_special versus pte_numa ... Sasha Levin has shown oopses on ffffea0003480048 and ffffea0003480008 at mm/memory.c:1132, running Trinity on different 3.16-rc-next kernels: where zap_pte_range() checks page->mapping to see if PageAnon(page). Those addresses fit struct pages for pfns d2001 and d2000, and in each dump a register or a stack slot showed d2001730 or d2000730: pte flags 0x730 are PCD ACCESSED PROTNONE SPECIAL IOMAP; and Sasha's e820 map has a hole between cfffffff and 100000000, which would need special access. Commit c46a7c817e ("x86: define _PAGE_NUMA by reusing software bits on the PMD and PTE levels") has broken vm_normal_page(): a PROTNONE SPECIAL pte no longer passes the pte_special() test, so zap_pte_range() goes on to try to access a non-existent struct page. Fix this by refining pte_special() (SPECIAL with PRESENT or PROTNONE) to complement pte_numa() (SPECIAL with neither PRESENT nor PROTNONE). A hint that this was a problem was that c46a7c817e added pte_numa() test to vm_normal_page(), and moved its is_zero_pfn() test from slow to fast path: This was papering over a pte_special() snag when the zero page was encountered during zap. This patch reverts vm_normal_page() to how it was before, relying on pte_special(). It still appears that this patch may be incomplete: aren't there other places which need to be handling PROTNONE along with PRESENT? For example, pte_mknuma() clears _PAGE_PRESENT and sets _PAGE_NUMA, but on a PROT_NONE area, that would make it pte_special(). This is side-stepped by the fact that NUMA hinting faults skipped PROT_NONE VMAs and there are no grounds where a NUMA hinting fault on a PROT_NONE VMA would be interesting. Fixes: c46a7c817e ("x86: define _PAGE_NUMA by reusing software bits on the PMD and PTE levels") Reported-by: Sasha Levin <sasha.levin@oracle.com> Tested-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Rik van Riel <riel@redhat.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Cyrill Gorcunov <gorcunov@gmail.com> Cc: Matthew Wilcox <matthew.r.wilcox@intel.com> Cc: <stable@vger.kernel.org> [3.16] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-08-29 16:28:16 -07:00
..
backing-dev.c
balloon_compaction.c
bootmem.c
cleancache.c
cma.c
compaction.c
debug-pagealloc.c
dmapool.c
early_ioremap.c
fadvise.c
failslab.c
filemap_xip.c
filemap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-08-11 11:44:11 -07:00
fremap.c
frontswap.c
gup.c
highmem.c
huge_memory.c	mm: memcontrol: rewrite charge API	2014-08-08 15:57:17 -07:00
hugetlb_cgroup.c	hugetlb_cgroup: use lockdep_assert_held rather than spin_is_locked	2014-08-29 16:28:16 -07:00
hugetlb.c
hwpoison-inject.c
init-mm.c
internal.h
interval_tree.c
iov_iter.c	switch iov_iter_get_pages() to passing maximal number of pages	2014-08-07 14:40:11 -04:00
Kconfig
Kconfig.debug
kmemcheck.c
kmemleak-test.c
kmemleak.c
ksm.c
list_lru.c
maccess.c
madvise.c
Makefile
memblock.c	memblock, memhotplug: fix wrong type in memblock_find_in_range_node().	2014-08-29 16:28:15 -07:00
memcontrol.c	mm: memcontrol: avoid charge statistics churn during page migration	2014-08-08 15:57:18 -07:00
memory_hotplug.c
memory-failure.c
memory.c	x86,mm: fix pte_special versus pte_numa	2014-08-29 16:28:16 -07:00
mempolicy.c
mempool.c
migrate.c	mm: memcontrol: rewrite uncharge API	2014-08-08 15:57:17 -07:00
mincore.c
mlock.c
mm_init.c
mmap.c	mm: allow drivers to prevent new writable mappings	2014-08-08 15:57:31 -07:00
mmu_context.c
mmu_notifier.c
mmzone.c
mprotect.c
mremap.c
msync.c
nobootmem.c
nommu.c	arm64,ia64,ppc,s390,sh,tile,um,x86,mm: remove default gate area	2014-08-08 15:57:27 -07:00
oom_kill.c
page_alloc.c
page_cgroup.c
page_io.c
page_isolation.c
page-writeback.c
pagewalk.c
percpu-km.c
percpu-vm.c
percpu.c
pgtable-generic.c	mm: actually clear pmd_numa before invalidating	2014-08-29 16:28:15 -07:00
process_vm_access.c
quicklist.c
readahead.c
rmap.c	mm: memcontrol: rewrite uncharge API	2014-08-08 15:57:17 -07:00
shmem.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-08-11 11:44:11 -07:00
slab_common.c
slab.c	Revert "slab: remove BAD_ALIEN_MAGIC"	2014-08-08 15:57:17 -07:00
slab.h
slob.c
slub.c
sparse-vmemmap.c
sparse.c
swap_state.c	mm: allow drivers to prevent new writable mappings	2014-08-08 15:57:31 -07:00
swap.c	mm: memcontrol: use page lists for uncharge batching	2014-08-08 15:57:18 -07:00
swapfile.c	mm: memcontrol: rewrite uncharge API	2014-08-08 15:57:17 -07:00
truncate.c	mm: memcontrol: rewrite uncharge API	2014-08-08 15:57:17 -07:00
util.c	vm_is_stack: use for_each_thread() rather then buggy while_each_thread()	2014-08-08 15:57:17 -07:00
vmacache.c
vmalloc.c
vmpressure.c
vmscan.c	mm: memcontrol: use page lists for uncharge batching	2014-08-08 15:57:18 -07:00
vmstat.c
workingset.c
zbud.c	mm/zpool: use prefixed module loading	2014-08-29 16:28:16 -07:00
zpool.c	mm/zpool: use prefixed module loading	2014-08-29 16:28:16 -07:00
zsmalloc.c	mm/zpool: use prefixed module loading	2014-08-29 16:28:16 -07:00
zswap.c	mm/zswap.c: add __init to zswap_entry_cache_destroy()	2014-08-08 15:57:18 -07:00