[patch 39/43] x86, pat: fix PTE corruption issue while mapping RAM using /dev/mem

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Suresh Siddha <suresh.b.siddha@xxxxxxxxx>

commit 9597134218300c045cf219be3664615e97cb239c upstream.

Beschorner Daniel reported:
hwinfo problem since 2.6.28, showing this in the oops:
Corrupted page table at address 7fd04de3ec00

Also, PaX Team reported a regression with this commit:

commit 9542ada803198e6eba29d3289abb39ea82047b92
Author: Suresh Siddha <suresh.b.siddha@xxxxxxxxx>
Date: Wed Sep 24 08:53:33 2008 -0700

x86: track memtype for RAM in page struct

This commit breaks mapping any RAM page through /dev/mem, as the
reserve_memtype() was not initializing the return attribute type and as such
corrupting the PTE entry that was setup with the return attribute type.

Because of this bug, application mapping this RAM page through /dev/mem
will die with "Corrupted page table at address xxxx" message in the kernel
log and also the kernel identity mapping which maps the underlying RAM
page gets converted to UC.

Fix this by initializing the return attribute type before calling
reserve_ram_pages_type()

Reported-by: PaX Team <pageexec@xxxxxxxxxxx>
Reported-and-tested-by: Beschorner Daniel <Daniel.Beschorner@xxxxxxxxxx>
Tested-and-Acked-by: PaX Team <pageexec@xxxxxxxxxxx>
Signed-off-by: Suresh Siddha <suresh.b.siddha@xxxxxxxxx>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@xxxxxxxxx>
Signed-off-by: Ingo Molnar <mingo@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxx>

---
arch/x86/mm/pat.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -333,6 +333,9 @@ int reserve_memtype(u64 start, u64 end,
req_type & _PAGE_CACHE_MASK);
}

+ if (new_type)
+ *new_type = actual_type
+
/*
* For legacy reasons, some parts of the physical address range in the
* legacy 1MB region is treated as non-RAM (even when listed as RAM in
@@ -356,9 +359,6 @@ int reserve_memtype(u64 start, u64 end,
new->end = end;
new->type = actual_type;

- if (new_type)
- *new_type = actual_type;
-
spin_lock(&memtype_lock);

if (cached_entry && start >= cached_start)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: Prevent command prompt from popping up at system startup
    ... I call commit on boot time because actually it doesn't ... I'm using RAM Reg mode to protect the lifetime of the CompactFlash ... Maybe to commit the overly when the system runs, ... The storage is still protected (calls are redirected to the EWF overlay). ...
    (microsoft.public.windowsxp.embedded)
  • [2.6.25-rc1 regression] Suspend to RAM (bisected)
    ... commit bc71bec91f9875ef825d12104acf3bf4ca215fa4 ... The problem with suspend to RAM is that right after typing ... I tried to revert the above commit on top of 2.6.25-rc1, ...
    (Linux-Kernel)
  • Re: [REGRESSION]fan turns at highspeed after suspend2ram
    ... On Sunday, 10 of February 2008, Mirco Tischler wrote: ... ram, the fan of my laptop turns constantly at highest speed. ... I bisected it down to this commit: ...
    (Linux-Kernel)
  • Re: Exact memory used
    ... Is there a way to find out how much of memory is actually being used at ... Does the commit number in task manager indicate the ... If the total commit nears or exceeds your total physical RAM ...
    (microsoft.public.windowsxp.hardware)
  • Re: Something corrupts raid5 disks slightly during reboot
    ... > I have seen the very same symptome caused by RAM faults (too slow ram ... >20 workstations onto 6 ide disks) for weeks without ever corrupting ... send the line "unsubscribe linux-kernel" in ...
    (Linux-Kernel)
Loading