linux-toradex.git/mm/mincore.c, branch v2.6.33.14

mm: hugetlb: fix hugepage memory leak in mincore()

2009-12-15T16:53:24+00:00

Most callers of pmd_none_or_clear_bad() check whether the target page is
in a hugepage or not, but mincore() and walk_page_range() do not check it.
 So if we use mincore() on a hugepage on x86 machine, the hugepage memory
is leaked as shown below.  This patch fixes it by extending mincore()
system call to support hugepages.

Details
=======
My test program (leak_mincore) works as follows:
 - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,)
 - read()/write() something on it,
 - call mincore() for first ten pages and printf() the values of *vec
 - munmap() and unlink() the file on hugetlbfs

Without my patch
----------------
$ cat /proc/meminfo| grep "HugePage"
HugePages_Total:    1000
HugePages_Free:     1000
HugePages_Rsvd:        0
HugePages_Surp:        0
$ ./leak_mincore
vec[0] 0
vec[1] 0
vec[2] 0
vec[3] 0
vec[4] 0
vec[5] 0
vec[6] 0
vec[7] 0
vec[8] 0
vec[9] 0
$ cat /proc/meminfo |grep "HugePage"
HugePages_Total:    1000
HugePages_Free:      999
HugePages_Rsvd:        0
HugePages_Surp:        0
$ ls /hugetlbfs/
$

Return values in *vec from mincore() are set to 0, while the hugepage
should be in memory, and 1 hugepage is still accounted as used while
there is no file on hugetlbfs.

With my patch
-------------
$ cat /proc/meminfo| grep "HugePage"
HugePages_Total:    1000
HugePages_Free:     1000
HugePages_Rsvd:        0
HugePages_Surp:        0
$ ./leak_mincore
vec[0] 1
vec[1] 1
vec[2] 1
vec[3] 1
vec[4] 1
vec[5] 1
vec[6] 1
vec[7] 1
vec[8] 1
vec[9] 1
$ cat /proc/meminfo |grep "HugePage"
HugePages_Total:    1000
HugePages_Free:     1000
HugePages_Rsvd:        0
HugePages_Surp:        0
$ ls /hugetlbfs/
$

Return value in *vec set to 1 and no memory leaks.

[akpm@linux-foundation.org: cleanup]
[akpm@linux-foundation.org: build fix]
Signed-off-by: Naoya Horiguchi 
Cc: Andi Kleen 
Cc: Wu Fengguang 
Cc: Hugh Dickins 
Cc: Mel Gorman 
Cc: Lee Schermerhorn 
Cc: Andy Whitcroft 
Cc: David Rientjes 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[CVE-2009-0029] System call wrappers part 14

2009-01-14T13:15:24+00:00

Signed-off-by: Heiko Carstens

mm: remove nopage

2008-04-28T15:58:18+00:00

Nothing in the tree uses nopage any more.  Remove support for it in the
core mm code and documentation (and a few stray references to it in
comments).

Signed-off-by: Nick Piggin 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] mincore: vma crossing fix

2007-02-15T17:57:03+00:00

My mincore also forgot about crossing vmas.

Signed-off-by: Nick Piggin 
Signed-off-by: Linus Torvalds

[PATCH] mincore: fill in results properly

2007-02-15T17:57:03+00:00

Paper bag time. Thanks to Randy for noticing that I didn't actually assign
'present' to anything.

Unfortunately my original patch passed the few simple test cases I gave it,
purely by coincidence.

Signed-off-by: Nick Piggin 
Signed-off-by: Linus Torvalds

[PATCH] mincore: CONFIG_SWAP=n fix

2007-02-15T17:57:03+00:00

Fix mincore-anon patch to compile with CONFIG_SWAP=n

Signed-off-by: Nick Piggin 
Signed-off-by: Linus Torvalds

[PATCH] mm: mincore anon

2007-02-12T17:48:27+00:00

Make mincore work for anon mappings, nonlinear, and migration entries.
Based on patch from Linus Torvalds .

Signed-off-by: Nick Piggin 
Acked-by: Hugh Dickins 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] sys_mincore: s/max/min/

2006-12-17T18:21:53+00:00

fix a typo, sys_mincore() needs min().

Signed-off-by: Oleg Nesterov 
Signed-off-by: Linus "I'm a moron" Torvalds

Fix up mm/mincore.c error value cases

2006-12-17T00:01:50+00:00

Hugh Dickins correctly points out that mincore() is actually _supposed_
to fail on an unmapped hole in the user address space, rather than
return valid ("empty") information about the hole.  This just simplifies
the problem further (I had been misled by our previous confusing and
complicated way of doing mincore()).

Also, in the unlikely situation that we can't allocate a temporary
kernel buffer, we should actually return EAGAIN, not ENOMEM, to keep the
"unmapped hole" and "allocation failure" error cases separate.

Finally, add a comment about our stupid historical lack of support for
anonymous mappings.  I'll fix that if somebody reminds me after 2.6.20
is out.

Acked-by: Hugh Dickins 
Signed-off-by: Linus Torvalds

Fix incorrect user space access locking in mincore()

2006-12-16T17:44:32+00:00

Doug Chapman noticed that mincore() will doa "copy_to_user()" of the
result while holding the mmap semaphore for reading, which is a big
no-no.  While a recursive read-lock on a semaphore in the case of a page
fault happens to work, we don't actually allow them due to deadlock
schenarios with writers due to fairness issues.

Doug and Marcel sent in a patch to fix it, but I decided to just rewrite
the mess instead - not just fixing the locking problem, but making the
code smaller and (imho) much easier to understand.

Cc: Doug Chapman 
Cc: Marcel Holtmann 
Cc: Hugh Dickins 
Cc: Andrew Morton 
Signed-off-by: Linus Torvalds