dax: fix __dax_pmd_fault crash

djbw · djbw · commit 152d7bd80dca · 2015-11-12T18:33:54.000-08:00
Since 4.3 introduced devm_memremap_pages() the pfns handled by DAX may
optionally have a struct page backing.  When a mapped pfn reaches
vmf_insert_pfn_pmd() it fails with a crash signature like the following:

 kernel BUG at mm/huge_memory.c:905!
 [..]
 Call Trace:
  [&lt;ffffffff812a73ba&gt;] __dax_pmd_fault+0x2ea/0x5b0
  [&lt;ffffffffa01a4182&gt;] xfs_filemap_pmd_fault+0x92/0x150 [xfs]
  [&lt;ffffffff811fbe02&gt;] handle_mm_fault+0x312/0x1b50

Fix this by falling back to 4K mappings in the pfn_valid() case.  Longer
term, vmf_insert_pfn_pmd() needs to grow support for architectures that
can provide a 'pmd_special' capability.

Cc: &lt;stable@vger.kernel.org&gt;
Cc: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Reported-by: Ross Zwisler &lt;ross.zwisler@linux.intel.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
diff --git a/fs/dax.c b/fs/dax.c
@@ -627,6 +627,13 @@ int __dax_pmd_fault(struct vm_area_struct *vma, unsigned long address,
 		if ((length < PMD_SIZE) || (pfn & PG_PMD_COLOUR))
 			goto fallback;
 
+		/*
+		 * TODO: teach vmf_insert_pfn_pmd() to support
+		 * 'pte_special' for pmds
+		 */
+		if (pfn_valid(pfn))
+			goto fallback;
+
 		if (buffer_unwritten(&bh) || buffer_new(&bh)) {
 			int i;
 			for (i = 0; i < PTRS_PER_PMD; i++)
