From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Ankit Jain <ankijain@codeaurora.org>,
Will Deacon <will.deacon@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>
Subject: [PATCH 4.9 42/64] arm64: fault: Route pte translation faults via do_translation_fault
Date: Tue, 3 Oct 2017 14:23:34 +0200 [thread overview]
Message-ID: <20171003114230.984565112@linuxfoundation.org> (raw)
In-Reply-To: <20171003114228.884821129@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 760bfb47c36a07741a089bf6a28e854ffbee7dc9 upstream.
We currently route pte translation faults via do_page_fault, which elides
the address check against TASK_SIZE before invoking the mm fault handling
code. However, this can cause issues with the path walking code in
conjunction with our word-at-a-time implementation because
load_unaligned_zeropad can end up faulting in kernel space if it reads
across a page boundary and runs into a page fault (e.g. by attempting to
read from a guard region).
In the case of such a fault, load_unaligned_zeropad has registered a
fixup to shift the valid data and pad with zeroes, however the abort is
reported as a level 3 translation fault and we dispatch it straight to
do_page_fault, despite it being a kernel address. This results in calling
a sleeping function from atomic context:
BUG: sleeping function called from invalid context at arch/arm64/mm/fault.c:313
in_atomic(): 0, irqs_disabled(): 0, pid: 10290
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[...]
[<ffffff8e016cd0cc>] ___might_sleep+0x134/0x144
[<ffffff8e016cd158>] __might_sleep+0x7c/0x8c
[<ffffff8e016977f0>] do_page_fault+0x140/0x330
[<ffffff8e01681328>] do_mem_abort+0x54/0xb0
Exception stack(0xfffffffb20247a70 to 0xfffffffb20247ba0)
[...]
[<ffffff8e016844fc>] el1_da+0x18/0x78
[<ffffff8e017f399c>] path_parentat+0x44/0x88
[<ffffff8e017f4c9c>] filename_parentat+0x5c/0xd8
[<ffffff8e017f5044>] filename_create+0x4c/0x128
[<ffffff8e017f59e4>] SyS_mkdirat+0x50/0xc8
[<ffffff8e01684e30>] el0_svc_naked+0x24/0x28
Code: 36380080 d5384100 f9400800 9402566d (d4210000)
---[ end trace 2d01889f2bca9b9f ]---
Fix this by dispatching all translation faults to do_translation_faults,
which avoids invoking the page fault logic for faults on kernel addresses.
Reported-by: Ankit Jain <ankijain@codeaurora.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/fault.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -509,7 +509,7 @@ static const struct fault_info fault_inf
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 0 translation fault" },
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 1 translation fault" },
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 2 translation fault" },
- { do_page_fault, SIGSEGV, SEGV_MAPERR, "level 3 translation fault" },
+ { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 3 translation fault" },
{ do_bad, SIGBUS, 0, "unknown 8" },
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 access flag fault" },
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 access flag fault" },
next prev parent reply other threads:[~2017-10-03 12:27 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-03 12:22 [PATCH 4.9 00/64] 4.9.53-stable review Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 01/64] cifs: release cifs root_cred after exit_cifs Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 02/64] cifs: release auth_key.response for reconnect Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 03/64] fs/proc: Report eip/esp in /prod/PID/stat for coredumping Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 04/64] mac80211: fix VLAN handling with TXQs Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 05/64] mac80211_hwsim: Use proper TX power Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 06/64] mac80211: flush hw_roc_start work before cancelling the ROC Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 07/64] genirq: Make sparse_irq_lock protect what it should protect Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 08/64] KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 09/64] KVM: PPC: Book3S HV: Protect updates to spapr_tce_tables list Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 10/64] tracing: Fix trace_pipe behavior for instance traces Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 11/64] tracing: Erase irqsoff trace with empty write Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 12/64] md/raid5: fix a race condition in stripe batch Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 13/64] md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 14/64] scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesnt parse nlmsg properly Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 15/64] drm/radeon: disable hard reset in hibernate for APUs Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 16/64] crypto: drbg - fix freeing of resources Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 17/64] crypto: talitos - Dont provide setkey for non hmac hashing algs Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 18/64] crypto: talitos - fix sha224 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 19/64] crypto: talitos - fix hashing Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 20/64] security/keys: properly zero out sensitive key material in big_key Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 21/64] security/keys: rewrite all of big_key crypto Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 22/64] KEYS: fix writing past end of user-supplied buffer in keyring_read() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 23/64] KEYS: prevent creating a different users keyrings Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 24/64] KEYS: prevent KEYCTL_READ on negative key Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 25/64] powerpc/pseries: Fix parent_dn reference leak in add_dt_node() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 26/64] powerpc/tm: Flush TM only if CPU has TM feature Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 27/64] powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 28/64] s390/mm: fix write access check in gup_huge_pmd() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 29/64] PM: core: Fix device_pm_check_callbacks() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 30/64] Fix SMB3.1.1 guest authentication to Samba Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 31/64] SMB3: Warn user if trying to sign connection that authenticated as guest Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 32/64] SMB: Validate negotiate (to protect against downgrade) even if signing off Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 33/64] SMB3: Dont ignore O_SYNC/O_DSYNC and O_DIRECT flags Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 34/64] vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 35/64] nl80211: check for the required netlink attributes presence Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 36/64] bsg-lib: dont free job in bsg_prepare_job Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 37/64] iw_cxgb4: remove the stid on listen create failure Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 38/64] iw_cxgb4: put ep reference in pass_accept_req() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 39/64] selftests/seccomp: Support glibc 2.26 siginfo_t.h Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 40/64] seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 41/64] arm64: Make sure SPsel is always set Greg Kroah-Hartman
2017-10-03 12:23 ` Greg Kroah-Hartman [this message]
2017-10-03 12:23 ` [PATCH 4.9 46/64] kvm/x86: Handle async PF in RCU read-side critical sections Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 48/64] kvm: nVMX: Dont allow L2 to access the hardware CR8 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 49/64] xfs: validate bdev support for DAX inode flag Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 50/64] etnaviv: fix gem object list corruption Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 51/64] PCI: Fix race condition with driver_override Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 52/64] btrfs: fix NULL pointer dereference from free_reloc_roots() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 53/64] btrfs: propagate error to btrfs_cmp_data_prepare caller Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 54/64] btrfs: prevent to set invalid default subvolid Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 55/64] x86/mm: Fix fault error path using unsafe vma pointer Greg Kroah-Hartman
2017-10-03 12:23 ` Greg Kroah-Hartman
2017-10-03 12:23 ` [kernel-hardening] [PATCH 4.9 56/64] x86/fpu: Dont let userspace set bogus xcomp_bv Greg Kroah-Hartman
2017-10-03 12:23 ` Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 57/64] gfs2: Fix debugfs glocks dump Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 58/64] timer/sysclt: Restrict timer migration sysctl values to 0 and 1 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 61/64] cxl: Fix driver use count Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 62/64] KVM: VMX: use cmpxchg64 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 63/64] video: fbdev: aty: do not leak uninitialized padding in clk to userspace Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 64/64] swiotlb-xen: implement xen_swiotlb_dma_mmap callback Greg Kroah-Hartman
2017-10-03 19:27 ` [PATCH 4.9 00/64] 4.9.53-stable review Shuah Khan
2017-10-03 20:29 ` Tom Gall
2017-10-04 7:56 ` Greg Kroah-Hartman
2017-10-03 20:42 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171003114230.984565112@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ankijain@codeaurora.org \
--cc=catalin.marinas@arm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.