Hm, it just seems that its trying to unpin an mm on the error path of
execve, and so it hasn't been pinned. The simplest way to reproduce is:
$ echo foo > foo
$ chmod +x foo
$ ./foo
Anyway, try this patch.
J
---
arch/i386/xen/mmu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
===================================================================
--- a/arch/i386/xen/mmu.c
+++ b/arch/i386/xen/mmu.c
@@ -558,6 +558,9 @@ void xen_exit_mmap(struct mm_struct *mm)
put_cpu();
spin_lock(&mm->page_table_lock);
- xen_pgd_unpin(mm->pgd);
+
+ /* pgd may not be pinned in the error exit path of execve */
+ if (PagePinned(virt_to_page(mm->pgd)))
+ xen_pgd_unpin(mm->pgd);
spin_unlock(&mm->page_table_lock);
}
-