diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2023-01-31 05:53:52 +0100 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2023-03-02 18:31:40 +0100 |
| commit | 15261678a8c2ff093ffedad730b1646d34a1716a (patch) | |
| tree | 51b0d694d678e8653786acc25af6e5a3b1fc7278 | |
| parent | hexagon: fix livelock in uaccess (diff) | |
| download | linux-15261678a8c2ff093ffedad730b1646d34a1716a.tar.xz linux-15261678a8c2ff093ffedad730b1646d34a1716a.zip | |
parisc: fix livelock in uaccess
parisc equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling"
If e.g. get_user() triggers a page fault and a fatal signal is caught, we might
end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything
to page tables. In such case we must *not* return to the faulting insn -
that would repeat the entire thing without making any progress; what we need
instead is to treat that as failed (user) memory access.
Tested-by: Helge Deller <deller@gmx.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | arch/parisc/mm/fault.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c index 869204e97ec9..6941fdbf2517 100644 --- a/arch/parisc/mm/fault.c +++ b/arch/parisc/mm/fault.c @@ -308,8 +308,13 @@ good_area: fault = handle_mm_fault(vma, address, flags, regs); - if (fault_signal_pending(fault, regs)) + if (fault_signal_pending(fault, regs)) { + if (!user_mode(regs)) { + msg = "Page fault: fault signal on kernel memory"; + goto no_context; + } return; + } /* The fault is fully completed (including releasing mmap lock) */ if (fault & VM_FAULT_COMPLETED) |