mm, x86: fix pte_page() crash in gup_pte_range()
authorHugh Dickins <hughd@google.com>
Wed, 17 Feb 2016 21:11:23 +0000 (13:11 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 19 Feb 2016 00:23:24 +0000 (16:23 -0800)
commit457a98b0809fa6cde7aab8c314a59d99772b445e
tree61fd434ac02707ba73f84db22a802215dd8469cf
parent0918f1c309b86301605650c836ddd2021d311ae2
mm, x86: fix pte_page() crash in gup_pte_range()

Commit 3565fce3a659 ("mm, x86: get_user_pages() for dax mappings") has
moved up the pte_page(pte) in x86's fast gup_pte_range(), for no
discernible reason: put it back where it belongs, after the pte_flags
check and the pfn_valid cross-check.

That may be the cause of the NULL pointer dereference in
gup_pte_range(), seen when vfio called vaddr_get_pfn() when starting a
qemu-kvm based VM.

Signed-off-by: Hugh Dickins <hughd@google.com>
Reported-by: Michael Long <Harn-Solo@gmx.de>
Tested-by: Michael Long <Harn-Solo@gmx.de>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
arch/x86/mm/gup.c