Re: [PATCH] mm: Fix mmap MAP_POPULATE for DAX pmd mapping

From: Dan Williams
Date: Mon Nov 30 2015 - 17:08:59 EST

On Mon, Nov 23, 2015 at 12:04 PM, Toshi Kani <toshi.kani@xxxxxxx> wrote:
> The following oops was observed when mmap() with MAP_POPULATE
> pre-faulted pmd mappings of a DAX file. follow_trans_huge_pmd()
> expects that a target address has a struct page.
> BUG: unable to handle kernel paging request at ffffea0012220000
> follow_trans_huge_pmd+0xba/0x390
> follow_page_mask+0x33d/0x420
> __get_user_pages+0xdc/0x800
> populate_vma_page_range+0xb5/0xe0
> __mm_populate+0xc5/0x150
> vm_mmap_pgoff+0xd5/0xe0
> SyS_mmap_pgoff+0x1c1/0x290
> SyS_mmap+0x1b/0x30
> Fix it by making the PMD pre-fault handling consistent with PTE.
> After pre-faulted in faultin_page(), follow_page_mask() calls
> follow_trans_huge_pmd(), which is changed to call follow_pfn_pmd()
> for VM_PFNMAP or VM_MIXEDMAP. follow_pfn_pmd() handles FOLL_TOUCH
> and returns with -EEXIST.
> Reported-by: Mauricio Porto <mauricio.porto@xxxxxxx>
> Signed-off-by: Toshi Kani <toshi.kani@xxxxxxx>
> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> Cc: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
> Cc: Matthew Wilcox <willy@xxxxxxxxxxxxxxx>
> Cc: Dan Williams <dan.j.williams@xxxxxxxxx>
> Cc: Ross Zwisler <ross.zwisler@xxxxxxxxxxxxxxx>
> ---

Hey Toshi,

I ended up fixing this differently with follow_pmd_devmap() introduced
in this series:

Does the latest libnvdimm-pending branch [1] pass your test case?

[1]: git:// libnvdimm-pending
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at