• Stuart Bennett's avatar
    x86 mmiotrace: fix remove_kmmio_fault_pages() · d0fc63f7
    Stuart Bennett authored
    Impact: fix race+crash in mmiotrace
    
    The list manipulation in remove_kmmio_fault_pages() was broken. If more
    than one consecutive kmmio_fault_page was re-added during the grace
    period between unregister_kmmio_probe() and remove_kmmio_fault_pages(),
    the list manipulation failed to remove pages from the release list.
    
    After a second grace period the pages get into rcu_free_kmmio_fault_pages()
    and raise a BUG_ON() kernel crash.
    
    The list manipulation is fixed to properly remove pages from the release
    list.
    
    This bug has been present from the very beginning of mmiotrace in the
    mainline kernel. It was introduced in 0fd0e3da ("x86: mmiotrace full
    patch, preview 1");
    
    An urgent fix for Linus. Tested by Stuart (on 32-bit) and Pekka
    (on amd and intel 64-bit systems, nouveau and nvidia proprietary).
    Signed-off-by: default avatarStuart Bennett <stuart@freedesktop.org>
    Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
    LKML-Reference: <20090308202135.34933feb@daedalus.pq.iki.fi>
    Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
    d0fc63f7
kmmio.c 14.7 KB