diff options
author | Andrea Arcangeli <aarcange@redhat.com> | 2017-06-16 14:02:37 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-06-17 06:37:05 +0900 |
commit | 64c2b20301f62c697352c8028c569b1b2bdd8e82 (patch) | |
tree | 435b7139eca1e06238e50aca345a904d0f19ccd5 /mm | |
parent | 3c226c637b69104f6b9f1c6ec5b08d7b741b3229 (diff) | |
download | linux-64c2b20301f62c697352c8028c569b1b2bdd8e82.tar.gz linux-64c2b20301f62c697352c8028c569b1b2bdd8e82.tar.bz2 linux-64c2b20301f62c697352c8028c569b1b2bdd8e82.zip |
userfaultfd: shmem: handle coredumping in handle_userfault()
Anon and hugetlbfs handle FOLL_DUMP set by get_dump_page() internally to
__get_user_pages().
shmem as opposed has no special FOLL_DUMP handling there so
handle_mm_fault() is invoked without mmap_sem and ends up calling
handle_userfault() that isn't expecting to be invoked without mmap_sem
held.
This makes handle_userfault() fail immediately if invoked through
shmem_vm_ops->fault during coredumping and solves the problem.
The side effect is a BUG_ON with no lock held triggered by the
coredumping process which exits. Only 4.11 is affected, pre-4.11 anon
memory holes are skipped in __get_user_pages by checking FOLL_DUMP
explicitly against empty pagetables (mm/gup.c:no_page_table()).
It's zero cost as we already had a check for current->flags to prevent
futex to trigger userfaults during exit (PF_EXITING).
Link: http://lkml.kernel.org/r/20170615214838.27429-1-aarcange@redhat.com
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: <stable@vger.kernel.org> [4.11+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
0 files changed, 0 insertions, 0 deletions