lkml.org 
[lkml]   [2019]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v2] /dev/mem: Bail out upon SIGKILL.
Date
syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading 2GB at
one read() is legal, but delaying termination of killed thread for minutes
is bad. Let's insert cond_resched() and SIGKILL check into iteration loop
of reading/writing /dev/mem and /dev/kmem.

[ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
[ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
[ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
[ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
[ 1336.041897][T20577] read_mem: sz=4096 count=2134549248

[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40@syzkaller.appspotmail.com>
---
drivers/char/mem.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)

diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50..cb8e653 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -140,6 +140,10 @@ static ssize_t read_mem(struct file *file, char __user *buf,
int allowed, probe;

sz = size_inside_page(p, count);
+ cond_resched();
+ err = -EINTR;
+ if (fatal_signal_pending(current))
+ goto failed;

err = -EPERM;
allowed = page_is_allowed(p >> PAGE_SHIFT);
@@ -218,6 +222,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
int allowed;

sz = size_inside_page(p, count);
+ cond_resched();
+ if (fatal_signal_pending(current))
+ return -EINTR;

allowed = page_is_allowed(p >> PAGE_SHIFT);
if (!allowed)
@@ -451,6 +458,9 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
#endif
while (low_count > 0) {
sz = size_inside_page(p, low_count);
+ cond_resched();
+ if (fatal_signal_pending(current))
+ return -EINTR;

/*
* On ia64 if a page has been mapped somewhere as
@@ -477,6 +487,11 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
return -ENOMEM;
while (count > 0) {
sz = size_inside_page(p, count);
+ cond_resched();
+ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
if (!is_vmalloc_or_module_addr((void *)p)) {
err = -ENXIO;
break;
@@ -523,6 +538,9 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
void *ptr;

sz = size_inside_page(p, count);
+ cond_resched();
+ if (fatal_signal_pending(current))
+ return -EINTR;

/*
* On ia64 if a page has been mapped somewhere as uncached, then
@@ -581,6 +599,11 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
unsigned long sz = size_inside_page(p, count);
unsigned long n;

+ cond_resched();
+ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
if (!is_vmalloc_or_module_addr((void *)p)) {
err = -ENXIO;
break;
--
1.8.3.1
\
 
 \ /
  Last update: 2019-08-23 06:16    [W:0.055 / U:0.796 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site