From: Andrew Morton <akpm@linux-foundation.org>
To: Andrea Arcangeli <aarcange@redhat.com>
Cc: linux-mm@kvack.org, Mike Rapoport <rppt@linux.vnet.ibm.com>,
"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
Mike Kravetz <mike.kravetz@oracle.com>
Subject: Re: [PATCH 1/1] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size
Date: Mon, 16 Oct 2017 16:14:43 -0700 [thread overview]
Message-ID: <20171016161443.5365a280c44dc80e8c11298c@linux-foundation.org> (raw)
In-Reply-To: <20171016223914.2421-2-aarcange@redhat.com>
On Tue, 17 Oct 2017 00:39:14 +0200 Andrea Arcangeli <aarcange@redhat.com> wrote:
> kernel BUG at fs/hugetlbfs/inode.c:484!
> RIP: 0010:[<ffffffff815f8520>] [<ffffffff815f8520>] remove_inode_hugepages+0x3d0/0x410
> Call Trace:
> [<ffffffff815f95b9>] hugetlbfs_setattr+0xd9/0x130
> [<ffffffff81526312>] notify_change+0x292/0x410
> [<ffffffff816cc6b6>] ? security_inode_need_killpriv+0x16/0x20
> [<ffffffff81503c65>] do_truncate+0x65/0xa0
> [<ffffffff81504035>] ? do_sys_ftruncate.constprop.3+0xe5/0x180
> [<ffffffff8150406a>] do_sys_ftruncate.constprop.3+0x11a/0x180
> [<ffffffff8150410e>] SyS_ftruncate+0xe/0x10
> [<ffffffff81999f27>] tracesys+0xd9/0xde
>
> This oops was caused by the lack of i_size check in
> hugetlb_mcopy_atomic_pte. mmap() can still succeed beyond the end of
> the i_size after vmtruncate zapped vmas in those ranges, but the
> faults must not succeed, and that includes UFFDIO_COPY.
>
> We could differentiate the retval to userland to represent a SIGBUS
> like a page fault would do (vs SIGSEGV), but it doesn't seem very
> useful and we'd need to pick a random retval as there's no meaningful
> syscall retval that would differentiate from SIGSEGV and SIGBUS,
> there's just -EFAULT.
>
> Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
No cc:stable? The patch applies to 4.13 textually...
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-10-16 23:14 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-16 22:39 [PATCH 0/1] " Andrea Arcangeli
2017-10-16 22:39 ` [PATCH 1/1] userfaultfd: " Andrea Arcangeli
2017-10-16 23:14 ` Andrew Morton [this message]
2017-10-18 19:10 ` Andrea Arcangeli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171016161443.5365a280c44dc80e8c11298c@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=aarcange@redhat.com \
--cc=dgilbert@redhat.com \
--cc=linux-mm@kvack.org \
--cc=mike.kravetz@oracle.com \
--cc=rppt@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox