lkml.org 
[lkml]   [2020]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/2] mm/mempolicy: Allow lookup_node() to handle fatal signal
    Date
    lookup_node() uses gup to pin the page and get node information.  It
    checks against ret>=0 assuming the page will be filled in. However
    it's also possible that gup will return zero, for example, when the
    thread is quickly killed with a fatal signal. Teach lookup_node() to
    gracefully return an error -EFAULT if it happens.

    Meanwhile, initialize "page" to NULL to avoid potential risk of
    exploiting the pointer.

    Reported-by: syzbot+693dc11fcb53120b5559@syzkaller.appspotmail.com
    Fixes: 4426e945df58 ("mm/gup: allow VM_FAULT_RETRY for multiple times")
    Signed-off-by: Peter Xu <peterx@redhat.com>
    ---
    mm/mempolicy.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    diff --git a/mm/mempolicy.c b/mm/mempolicy.c
    index 5fb427aed612..c7ca6a808fb1 100644
    --- a/mm/mempolicy.c
    +++ b/mm/mempolicy.c
    @@ -897,12 +897,15 @@ static void get_policy_nodemask(struct mempolicy *p, nodemask_t *nodes)

    static int lookup_node(struct mm_struct *mm, unsigned long addr)
    {
    - struct page *p;
    + struct page *p = NULL;
    int err;

    int locked = 1;
    err = get_user_pages_locked(addr & PAGE_MASK, 1, 0, &p, &locked);
    - if (err >= 0) {
    + if (err == 0) {
    + /* E.g. GUP interrupted by fatal signal */
    + err = -EFAULT;
    + } else if (err > 0) {
    err = page_to_nid(p);
    put_page(p);
    }
    --
    2.24.1
    \
     
     \ /
      Last update: 2020-04-08 03:40    [W:6.725 / U:2.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site