[PATCH 4.4] s390/mm: Check for valid vma before zapping in gmap_discard

DORMANTno replies REVIEWED: 1 (0M)

From: Janosch Frank <frankja@linux.ibm.com>
Date: 2018-11-08 18:12:38
Subsystem: s390 architecture, the rest · Maintainers: Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Linus Torvalds

1 review trailer.

From: Janosch Frank <redacted>

Userspace could have munmapped the area before doing unmapping from
the gmap. This would leave us with a valid vmaddr, but an invalid vma
from which we would try to zap memory. Let's check before using the
vma.

Function was moved with 1e133ab296f3 in v4.6.
Is 1843abd upstream.

Fixes: 388186b ("kvm: Handle diagnose 0x10 (release pages)")
Signed-off-by: Janosch Frank <redacted>
Reviewed-by: David Hildenbrand <redacted>
Reported-by: Dan Carpenter <redacted>
CC: <redacted> # 4.4
---
 arch/s390/mm/pgtable.c | 2 ++
 1 file changed, 2 insertions(+)
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 05ae254..1866b6a 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -637,6 +637,8 @@ void gmap_discard(struct gmap *gmap, unsigned long from, unsigned long to)
 		vmaddr |= gaddr & ~PMD_MASK;
 		/* Find vma in the parent mm */
 		vma = find_vma(gmap->mm, vmaddr);
+		if (!vma)
+			continue;
 		size = min(to - gaddr, PMD_SIZE - (gaddr & ~PMD_MASK));
 		zap_page_range(vma, vmaddr, size, NULL);
 	}
-- 
2.7.4
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help