Commit 95971342 authored by Suresh Siddha's avatar Suresh Siddha Committed by Ingo Molnar

x86: fix PTE corruption issue while mapping RAM using /dev/mem

Beschorner Daniel reported:
> hwinfo problem since 2.6.28, showing this in the oops:
>	Corrupted page table at address 7fd04de3ec00

Also, PaX Team reported a regression with this commit:

>	commit 9542ada8
>	Author: Suresh Siddha <suresh.b.siddha@intel.com>
>	Date:   Wed Sep 24 08:53:33 2008 -0700
>
>	    x86: track memtype for RAM in page struct

This commit breaks mapping any RAM page through /dev/mem, as the
reserve_memtype() was not initializing the return attribute type and as such
corrupting the PTE entry that was setup with the return attribute type.

Because of this bug, application mapping this RAM page through /dev/mem
will die with "Corrupted page table at address xxxx" message in the kernel
log and also the kernel identity mapping which maps the underlying RAM
page gets converted to UC.

Fix this by initializing the return attribute type before calling
reserve_ram_pages_type()
Reported-by: default avatarPaX Team <pageexec@freemail.hu>
Reported-and-tested-by: default avatarBeschorner Daniel <Daniel.Beschorner@facton.com>
Tested-and-Acked-by: default avatarPaX Team <pageexec@freemail.hu>
Signed-off-by: default avatarSuresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: default avatarVenkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
parent 731f1872
...@@ -333,6 +333,9 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type, ...@@ -333,6 +333,9 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
req_type & _PAGE_CACHE_MASK); req_type & _PAGE_CACHE_MASK);
} }
if (new_type)
*new_type = actual_type;
/* /*
* For legacy reasons, some parts of the physical address range in the * For legacy reasons, some parts of the physical address range in the
* legacy 1MB region is treated as non-RAM (even when listed as RAM in * legacy 1MB region is treated as non-RAM (even when listed as RAM in
...@@ -356,9 +359,6 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type, ...@@ -356,9 +359,6 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
new->end = end; new->end = end;
new->type = actual_type; new->type = actual_type;
if (new_type)
*new_type = actual_type;
spin_lock(&memtype_lock); spin_lock(&memtype_lock);
if (cached_entry && start >= cached_start) if (cached_entry && start >= cached_start)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment