On Fri, Dec 06, 2013 at 02:38:28PM +0000, Richard Yao wrote: > On 12/06/2013 06:14 AM, Will Deacon wrote: > > On Wed, Dec 04, 2013 at 08:43:18PM +0000, Richard Yao wrote: > >> diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c > >> index 9c5a1aa..5d1d04b 100644 > >> --- a/net/9p/trans_virtio.c > >> +++ b/net/9p/trans_virtio.c > >> @@ -340,7 +340,10 @@ static int p9_get_mapped_pages(struct virtio_chan > >> *chan, > >> int count = nr_pages; > >> while (nr_pages) { > >> s = rest_of_page(data); > >> - pages[index++] = kmap_to_page(data); > >> + if (is_vmalloc_or_module_addr(data)) > > > > Can this really end up being a module address? > > Yes. Here is the stacktrace to prove it: > > [<ffffffff814878ce>] p9_virtio_zc_request+0x45e/0x510 > [<ffffffff814814ed>] p9_client_zc_rpc.constprop.16+0xfd/0x4f0 > [<ffffffff814839dd>] p9_client_read+0x15d/0x240 > [<ffffffff811c8440>] v9fs_fid_readn+0x50/0xa0 > [<ffffffff811c84a0>] v9fs_file_readn+0x10/0x20 > [<ffffffff811c84e7>] v9fs_file_read+0x37/0x70 > [<ffffffff8114e3fb>] vfs_read+0x9b/0x160 > [<ffffffff81153571>] kernel_read+0x41/0x60 > [<ffffffff810c83ab>] copy_module_from_fd.isra.34+0xfb/0x180 > [<ffffffff810cc420>] SyS_finit_module+0x70/0xd0 > [<ffffffff814a08fd>] system_call_fastpath+0x1a/0x1f > [<ffffffffffffffff>] 0xffffffffffffffff > > This is easily reproducible by trying to load a module off virtfs. QEMU > will print the message that I cited in the commit message and then kill > itself.
Ok, thanks for confirming! In which case, this patch looks fine to me: Reviewed-by: Will Deacon <will.dea...@arm.com> Will _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization