# git rev-parse -q --verify 38e088546522e1e86d2b8f401a1354ad3a9b3303^{commit} 38e088546522e1e86d2b8f401a1354ad3a9b3303 already have revision, skipping fetch # git checkout -q -f -B kisskb 38e088546522e1e86d2b8f401a1354ad3a9b3303 # git clean -qxdf # git log -1 commit 38e088546522e1e86d2b8f401a1354ad3a9b3303 Author: Lorenzo Stoakes Date: Sun Sep 11 23:54:25 2016 +0100 mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing The NUMA balancing logic uses an arch-specific PROT_NONE page table flag defined by pte_protnone() or pmd_protnone() to mark PTEs or huge page PMDs respectively as requiring balancing upon a subsequent page fault. User-defined PROT_NONE memory regions which also have this flag set will not normally invoke the NUMA balancing code as do_page_fault() will send a segfault to the process before handle_mm_fault() is even called. However if access_remote_vm() is invoked to access a PROT_NONE region of memory, handle_mm_fault() is called via faultin_page() and __get_user_pages() without any access checks being performed, meaning the NUMA balancing logic is incorrectly invoked on a non-NUMA memory region. A simple means of triggering this problem is to access PROT_NONE mmap'd memory using /proc/self/mem which reliably results in the NUMA handling functions being invoked when CONFIG_NUMA_BALANCING is set. This issue was reported in bugzilla (issue 99101) which includes some simple repro code. There are BUG_ON() checks in do_numa_page() and do_huge_pmd_numa_page() added at commit c0e7cad to avoid accidentally provoking strange behaviour by attempting to apply NUMA balancing to pages that are in fact PROT_NONE. The BUG_ON()'s are consistently triggered by the repro. This patch moves the PROT_NONE check into mm/memory.c rather than invoking BUG_ON() as faulting in these pages via faultin_page() is a valid reason for reaching the NUMA check with the PROT_NONE page table flag set and is therefore not always a bug. Link: https://bugzilla.kernel.org/show_bug.cgi?id=99101 Reported-by: Trevor Saunders Signed-off-by: Lorenzo Stoakes Acked-by: Rik van Riel Cc: Andrew Morton Cc: Mel Gorman Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/gcc-4.6.3-nolibc/i386-linux/bin/i386-linux-gcc --version # < git log --format=%s --max-count=1 38e088546522e1e86d2b8f401a1354ad3a9b3303 # < make -j 10 ARCH=i386 O=/home/kisskb/slave/build/linus_i386-randconfig_i386 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/i386-linux/bin/i386-linux- randconfig KCONFIG_SEED=0xFEA90F1E # Added to kconfig CONFIG_STANDALONE=y # Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y # yes \n | make -j 10 ARCH=i386 O=/home/kisskb/slave/build/linus_i386-randconfig_i386 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/i386-linux/bin/i386-linux- oldconfig yes: standard output: Broken pipe yes: write error # make -j 10 ARCH=i386 O=/home/kisskb/slave/build/linus_i386-randconfig_i386 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/i386-linux/bin/i386-linux- make[1]: Entering directory '/home/kisskb/slave/build/linus_i386-randconfig_i386' GEN ./Makefile scripts/kconfig/conf --silentoldconfig Kconfig SYSTBL arch/x86/entry/syscalls/../../include/generated/asm/syscalls_32.h SYSHDR arch/x86/entry/syscalls/../../include/generated/uapi/asm/unistd_32.h SYSHDR arch/x86/entry/syscalls/../../include/generated/uapi/asm/unistd_64.h CHK include/config/kernel.release SYSHDR arch/x86/entry/syscalls/../../include/generated/uapi/asm/unistd_x32.h HOSTCC scripts/basic/bin2c Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong not supported by compiler /home/kisskb/slave/src/Makefile:1048: recipe for target 'prepare-compiler-check' failed make[1]: *** [prepare-compiler-check] Error 1 make[1]: *** Waiting for unfinished jobs.... UPD include/config/kernel.release make[1]: *** wait: No child processes. Stop. Makefile:150: recipe for target 'sub-make' failed make: *** [sub-make] Error 2 Command 'make -j 10 ARCH=i386 O=/home/kisskb/slave/build/linus_i386-randconfig_i386 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/i386-linux/bin/i386-linux- ' returned non-zero exit status 2 # rm -rf /home/kisskb/slave/build/linus_i386-randconfig_i386 # Build took: 0:00:08.300685