Re: Regression in v4.0.0-rc1 with Android Binder

[David Rientjes]

On Thu, 26 Feb 2015, Arve HjÃnnevÃg wrote:

> > ----------8<----------
> > --- a/drivers/android/binder.c
> > +++ b/drivers/android/binder.c
> > @@ -601,6 +601,7 @@ static int binder_update_page_range(struct
> > binder_proc *proc, int allocate,
> >                         goto err_alloc_page_failed;
> >                 }
> >                 tmp_area.addr = page_addr;
> > +               tmp_area.flags &= ~VM_NO_GUARD;
> 
> This variable is not initialized, so I would expect this to add a
> warning. Setting it to VM_NO_GUARD and removing, " + PAGE_SIZE /*
> guard page? */" fromt he next line would be better. However, the "new"
> map_kernel_range_noflush api seems like a better api to use for this,
> since it removes the need to create a dummy vm_struct at all.
> 

Yeah, this is what you want to do and it's a bug in commit 71394fe50146 
("mm: vmalloc: add flag preventing guard hole allocation") that started to 
look at tmp_area.size without fixing up any of the callers when 
tmp_area.addr and tmp_area.size were only important in the past.  It 
shouldn't take much work to make this use map_kernel_range_noflush().

> >                 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
> >                 ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
> >                 if (ret) {
> > ---------->8----------