[PATCH RESEND] iommu/amd: Fix BUG when faulting a PROT_NONE VMA

[PATCH RESEND] iommu/amd: Fix BUG when faulting a PROT_NONE VMA

[Jay Cornwall]

handle_mm_fault indirectly triggers a BUG in do_numa_page when given
a VMA without read/write/execute access. Check this condition in do_fault.

do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page

  mm/memory.c
  3147  static int do_numa_page(struct mm_struct *mm, struct vm_area_st...
  ....
  3159  /* A PROT_NONE fault should not end up here */
  3160  BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));

Signed-off-by: Jay Cornwall <jay-gJmSnxjMpeIFV7jr3Ov9Ew@public.gmane.org>
---
 drivers/iommu/amd_iommu_v2.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index 1131664..d21d4ed 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -516,6 +516,13 @@ static void do_fault(struct work_struct *work)
 		goto out;
 	}
 
+	if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) {
+		/* handle_mm_fault would BUG_ON() */
+		up_read(&mm->mmap_sem);
+		handle_fault_error(fault);
+		goto out;
+	}
+
 	ret = handle_mm_fault(mm, vma, address, write);
 	if (ret & VM_FAULT_ERROR) {
 		/* failed to service fault */
-- 
1.9.1

Re: [PATCH RESEND] iommu/amd: Fix BUG when faulting a PROT_NONE VMA

[Joerg Roedel]

Hi Jay,

On Tue, Oct 13, 2015 at 04:52:43AM -0500, Jay Cornwall wrote:
> handle_mm_fault indirectly triggers a BUG in do_numa_page when given
> a VMA without read/write/execute access. Check this condition in do_fault.
> 
> do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page
> 
>   mm/memory.c
>   3147  static int do_numa_page(struct mm_struct *mm, struct vm_area_st...
>   ....
>   3159  /* A PROT_NONE fault should not end up here */
>   3160  BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));

Thanks for the fix! Next time please Cc me directly on patches for AMD
IOMMU code, so I see your patches earlier.

Also this looks relevant for stable, can you find out which stable
kernels need this fix too?


Thanks,

	Joerg

Re: [PATCH RESEND] iommu/amd: Fix BUG when faulting a PROT_NONE VMA

[Jay Cornwall]

On 2015-10-14 04:10, Joerg Roedel wrote:
> Hi Jay,
> 
> On Tue, Oct 13, 2015 at 04:52:43AM -0500, Jay Cornwall wrote:
>> handle_mm_fault indirectly triggers a BUG in do_numa_page when given
>> a VMA without read/write/execute access. Check this condition in 
>> do_fault.
>> 
>> do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page
>> 
>>   mm/memory.c
>>   3147  static int do_numa_page(struct mm_struct *mm, struct 
>> vm_area_st...
>>   ....
>>   3159  /* A PROT_NONE fault should not end up here */
>>   3160  BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
> 
> Thanks for the fix! Next time please Cc me directly on patches for AMD
> IOMMU code, so I see your patches earlier.
> 
> Also this looks relevant for stable, can you find out which stable
> kernels need this fix too?

Sure.

Cc: <stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> # v4.1+

-- 
Jay Cornwall

Re: [PATCH RESEND] iommu/amd: Fix BUG when faulting a PROT_NONE VMA

[Joerg Roedel]

On Wed, Oct 14, 2015 at 11:56:00AM -0500, Jay Cornwall wrote:
> On 2015-10-14 04:10, Joerg Roedel wrote:
> >Hi Jay,
> >
> >On Tue, Oct 13, 2015 at 04:52:43AM -0500, Jay Cornwall wrote:
> >>handle_mm_fault indirectly triggers a BUG in do_numa_page when given
> >>a VMA without read/write/execute access. Check this condition in
> >>do_fault.
> >>
> >>do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page
> >>
> >>  mm/memory.c
> >>  3147  static int do_numa_page(struct mm_struct *mm, struct
> >>vm_area_st...
> >>  ....
> >>  3159  /* A PROT_NONE fault should not end up here */
> >>  3160  BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
> >
> >Thanks for the fix! Next time please Cc me directly on patches for AMD
> >IOMMU code, so I see your patches earlier.
> >
> >Also this looks relevant for stable, can you find out which stable
> >kernels need this fix too?
> 
> Sure.
> 
> Cc: <stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> # v4.1+

Applied, thanks.