• M
    mm/nommu.c: return 0 from kobjsize with invalid objects · 4016a139
    Michael Hennerich 提交于
    Don't perform kobjsize operations on objects the kernel doesn't manage.
    
    On Blackfin, drivers can get dma coherent memory by calling a function
    dma_alloc_coherent(). We do this in nommu by configuring a chunk of uncached
    memory at the top of memory.
    
    Since we don't want the kernel to use the uncached memory, we lie to the
    kernel, and tell it that it's max memory is between 0, and the start of the
    uncached dma coherent section.
    
    this all works well, until this memory gets exposed into userspace (with a
    frame buffer), when you look at the process's maps, it shows the framebuf:
    
    root:/proc> cat maps
    [snip]
    03f0ef00-03f34700 rw-p 00000000 1f:00 192        /dev/fb0
    root:/proc>
    
    This is outside the "normal" range for the kernel. When the kernel tries to
    find the size of this object (when you run ps), it dies in nommu.c in
    kobjsize.
    
    BUG_ON(page->index >= MAX_ORDER);
    
    since the page we are referring to is outside what the kernel thinks is it's
    max valid memory.
    
    root:~> while [ 1 ]; ps > /dev/null; done
    kernel BUG at mm/nommu.c:119!
    Kernel panic - not syncing: BUG!
    
    We fixed this by adding a check to reject out of range object pointers as it
    already does that for NULL pointers.
    Signed-off-by: NMichael Hennerich <Michael.Hennerich@analog.com>
    Signed-off-by: NRobin Getz <rgetz@blackfin.uclinux.org>
    Acked-by: NDavid Howells <dhowells@redhat.com>
    Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
    4016a139
nommu.c 34.3 KB