diff options
| author | Zachary Amsden <zach@vmware.com> | 2007-08-23 01:02:02 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2007-08-31 10:01:01 +0400 |
| commit | f24e131c7e06c4f0bbb69bebf66d16bde48c3f31 (patch) | |
| tree | a145c29731dd85f1756527b5ff20e3e7d6d82c3d /arch | |
| parent | 6f157f740ceb977982d36abbf2f54ffbc3964190 (diff) | |
| download | linux-f24e131c7e06c4f0bbb69bebf66d16bde48c3f31.tar.xz | |
i386: fix lazy mode vmalloc synchronization for paravirt
Found this looping Ubuntu installs with VMI.
If unlucky enough to hit a vmalloc sync fault during a lazy mode
operation (from an IRQ handler for a module which was not yet populated
in current page directory, or from inside copy_one_pte, which touches
swap_map, and hit in an unused 4M region), the required PDE update would
never get flushed, causing an infinite page fault loop.
This bug affects any paravirt-ops backend which uses lazy updates, I
believe that makes it a bug in Xen, VMI and lguest. It only happens on
LOWMEM kernels.
Touching vmalloc memory in the middle of a lazy mode update can generate a
kernel PDE update, which must be flushed immediately. The fix is to leave
lazy mode when doing a vmalloc sync.
Signed-off-by: Zachary Amsden <zach@vmware.com>
Cc: Andi Kleen <ak@suse.de>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/i386/mm/fault.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/arch/i386/mm/fault.c b/arch/i386/mm/fault.c index 1ecb3e43b523..27ba2fd11483 100644 --- a/arch/i386/mm/fault.c +++ b/arch/i386/mm/fault.c @@ -249,9 +249,10 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address) pmd_k = pmd_offset(pud_k, address); if (!pmd_present(*pmd_k)) return NULL; - if (!pmd_present(*pmd)) + if (!pmd_present(*pmd)) { set_pmd(pmd, *pmd_k); - else + arch_flush_lazy_mmu_mode(); + } else BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k)); return pmd_k; } |