Re: [PATCH 1/1] userfaultfd: shmem: handle coredumping in handle_userfault()

[Andrew Morton <akpm@linux-foundation.org>]

On Fri, 16 Jun 2017 00:52:31 +0200 Andrea Arcangeli <aarcange@redhat.com> wrote:

> > Can we please get that description into the changelog so that others
> > can decide which kernel(s) need the fix?
> 
> Only 4.11 is affected, pre-4.11 anon memory holes are skipped in
> __get_user_pages by checking FOLL_DUMP explicitly against empty
> pagetables (mm/gup.c:no_page_table()).
> 
> Should I re-submit with this detail?

Is OK thanks, I updated the changelog and queued it for 4.12.


From: Andrea Arcangeli <aarcange@redhat.com>
Subject: userfaultfd: shmem: handle coredumping in handle_userfault()

Anon and hugetlbfs handle FOLL_DUMP set by get_dump_page() internally to
__get_user_pages().

shmem as opposed has no special FOLL_DUMP handling there so
handle_mm_fault() is invoked without mmap_sem and ends up calling
handle_userfault() that isn't expecting to be invoked without mmap_sem
held.

This makes handle_userfault() fail immediately if invoked through
shmem_vm_ops->fault during coredumping and solves the problem.

The side effect is a BUG_ON with no lock held triggered by the coredumping
process which exits.  Only 4.11 is affected, pre-4.11 anon memory holes
are skipped in __get_user_pages by checking FOLL_DUMP explicitly against
empty pagetables (mm/gup.c:no_page_table()).

It's zero cost as we already had a check for current->flags to prevent
futex to trigger userfaults during exit (PF_EXITING).

Link: http://lkml.kernel.org/r/20170615214838.27429-1-aarcange@redhat.com
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: <stable@vger.kernel.org>	[4.11+]

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>