mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-29 23:53:32 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/staging
History
John Stultz 44960f2a7b staging: ashmem: Fix SIGBUS crash when traversing mmaped ashmem pages 
Amit Pundir and Youling in parallel reported crashes with recent
mainline kernels running Android:

  F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
  F DEBUG   : Build fingerprint: 'Android/db410c32_only/db410c32_only:Q/OC-MR1/102:userdebug/test-key
  F DEBUG   : Revision: '0'
  F DEBUG   : ABI: 'arm'
  F DEBUG   : pid: 2261, tid: 2261, name: zygote  >>> zygote <<<
  F DEBUG   : signal 7 (SIGBUS), code 2 (BUS_ADRERR), fault addr 0xec00008
  ... <snip> ...
  F DEBUG   : backtrace:
  F DEBUG   :     #00 pc 00001c04  /system/lib/libc.so (memset+48)
  F DEBUG   :     #01 pc 0010c513  /system/lib/libart.so (create_mspace_with_base+82)
  F DEBUG   :     #02 pc 0015c601  /system/lib/libart.so (art::gc::space::DlMallocSpace::CreateMspace(void*, unsigned int, unsigned int)+40)
  F DEBUG   :     #03 pc 0015c3ed  /system/lib/libart.so (art::gc::space::DlMallocSpace::CreateFromMemMap(art::MemMap*, std::__1::basic_string<char, std::__ 1::char_traits<char>, std::__1::allocator<char>> const&, unsigned int, unsigned int, unsigned int, unsigned int, bool)+36)
  ...

This was bisected back to commit bfd40eaff5 ("mm: fix
vma_is_anonymous() false-positives").

create_mspace_with_base() in the trace above, utilizes ashmem, and with
ashmem, for shared mappings we use shmem_zero_setup(), which sets the
vma->vm_ops to &shmem_vm_ops.  But for private ashmem mappings nothing
sets the vma->vm_ops.

Looking at the problematic patch, it seems to add a requirement that one
call vma_set_anonymous() on a vma, otherwise the dummy_vm_ops will be
used.  Using the dummy_vm_ops seem to triggger SIGBUS when traversing
unmapped pages.

Thus, this patch adds a call to vma_set_anonymous() for ashmem private
mappings and seems to avoid the reported problem.

Fixes: bfd40eaff5 ("mm: fix vma_is_anonymous() false-positives")
Cc: Kirill Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Joel Fernandes <joelaf@google.com>
Cc: Colin Cross <ccross@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Reported-by: Amit Pundir <amit.pundir@linaro.org>
Reported-by: Youling 257 <youling257@gmail.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-08-01 10:08:57 -07:00
..
android staging: ashmem: Fix SIGBUS crash when traversing mmaped ashmem pages 2018-08-01 10:08:57 -07:00
board
clocking-wizard
comedi staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write() 2018-06-25 22:54:04 +08:00
dgnc
emxx_udc
fbtft - Core Frameworks 2018-06-11 07:23:19 -07:00
fsl-dpaa2 Staging/IIO patches for 4.18-rc1 2018-06-09 10:32:39 -07:00
fsl-mc docs: fix broken references with multiple hints 2018-06-15 18:10:01 -03:00
fwserial
gdm724x
goldfish
greybus treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
gs_fpgaboot
iio
ks7010 staging: ks7010: call 'hostif_mib_set_request_int' instead of 'hostif_mib_set_request_bool' 2018-07-16 10:04:11 +02:00
media media: staging: omap4iss: Include asm/cacheflush.h after generic includes 2018-07-24 10:43:34 -07:00
most
mt29f_spinand
mt7621-dma
mt7621-dts staging: mt7621-gpio: update #interrupt-cells for the gpio node 2018-06-01 13:16:23 +02:00
mt7621-eth
mt7621-gpio staging: mt7621-gpio: reorder includes alphabetically 2018-06-01 13:16:24 +02:00
mt7621-mmc staging: mt7621-mmc: Fix line size exceeding 80 columns 2018-06-01 10:52:48 +02:00
mt7621-pci staging: mt7621-pci: Fix line size exceeding 80 columns. 2018-05-31 19:00:53 +02:00
mt7621-pinctrl treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
mt7621-spi
netlogic
nvec
octeon
octeon-usb
olpc_dcon
pi433
rtl8188eu Revert "staging:r8188eu: Use lib80211 to support TKIP" 2018-07-16 10:04:11 +02:00
rtl8192e staging: rtl8192e: rtllib_tx: fix spelling issue. 2018-05-25 18:44:14 +02:00
rtl8192u treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
rtl8712
rtl8723bs staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data(). 2018-07-02 10:45:39 +02:00
rtlwifi staging: r8822be: Fix RTL8822be can't find any wireless AP 2018-07-06 17:44:35 +02:00
rts5208 treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
skein
sm750fb
speakup staging: speakup: fix wraparound in uaccess length check 2018-07-16 10:04:11 +02:00
typec staging/typec: fix tcpci_rt1711h build errors 2018-06-25 21:36:45 +08:00
unisys treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
vboxvideo Staging/IIO patches for 4.18-rc1 2018-06-09 10:32:39 -07:00
vc04_services staging: vc04_services: no need to save the log debufs dentries 2018-06-01 20:15:56 +02:00
vme
vt6655
vt6656
wilc1000 staging: wilc1000: Avoid overriding rates_no while parsing ies element. 2018-05-25 18:45:47 +02:00
wlan-ng staging: wlan-ng: remove unused declarations from p80211types.h 2018-05-31 19:00:53 +02:00
xgifb
Kconfig staging: ipx: delete it from the tree 2018-06-05 19:23:26 +02:00
Makefile staging: ipx: delete it from the tree 2018-06-05 19:23:26 +02:00