From: Peter Xu <peterx@redhat.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: syzbot <syzbot+693dc11fcb53120b5559@syzkaller.appspotmail.com>,
bgeffon@google.com, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, syzkaller-bugs@googlegroups.com,
torvalds@linux-foundation.org
Subject: Re: BUG: unable to handle kernel paging request in kernel_get_mempolicy
Date: Mon, 6 Apr 2020 21:55:35 -0400 [thread overview]
Message-ID: <20200407015535.GC48345@xz-x1> (raw)
In-Reply-To: <20200406183941.38a2e52026e42dbfde239a56@linux-foundation.org>
On Mon, Apr 06, 2020 at 06:39:41PM -0700, Andrew Morton wrote:
> On Mon, 6 Apr 2020 20:47:45 -0400 Peter Xu <peterx@redhat.com> wrote:
>
> > >From 23800bff6fa346a4e9b3806dc0cfeb74498df757 Mon Sep 17 00:00:00 2001
> > From: Peter Xu <peterx@redhat.com>
> > Date: Mon, 6 Apr 2020 20:40:13 -0400
> > Subject: [PATCH] mm/mempolicy: Allow lookup_node() to handle fatal signal
> >
> > lookup_node() uses gup to pin the page and get node information. It
> > checks against ret>=0 assuming the page will be filled in. However
> > it's also possible that gup will return zero, for example, when the
> > thread is quickly killed with a fatal signal. Teach lookup_node() to
> > gracefully return an error -EFAULT if it happens.
> >
> > ...
> >
> > --- a/mm/mempolicy.c
> > +++ b/mm/mempolicy.c
> > @@ -902,7 +902,10 @@ static int lookup_node(struct mm_struct *mm, unsigned long addr)
> >
> > int locked = 1;
> > err = get_user_pages_locked(addr & PAGE_MASK, 1, 0, &p, &locked);
> > - if (err >= 0) {
> > + if (err == 0) {
> > + /* E.g. GUP interupted by fatal signal */
> > + err = -EFAULT;
> > + } else if (err > 0) {
> > err = page_to_nid(p);
> > put_page(p);
> > }
>
> Doh. Thanks.
>
> Should it have been -EINTR?
It looks ok to me too. I was returning -EFAULT to follow the same
value as get_vaddr_frames() (which is the other caller of
get_user_pages_locked()). So far the only path that I found can
trigger this is when there's a fatal signal pending right after the
gup. If so, the userspace won't have a chance to see the -EINTR (or
whatever we return) anyways.
Thanks,
--
Peter Xu
next prev parent reply other threads:[~2020-04-07 1:55 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-06 18:16 BUG: unable to handle kernel paging request in kernel_get_mempolicy syzbot
2020-04-07 0:47 ` Peter Xu
2020-04-07 1:05 ` Randy Dunlap
2020-04-07 1:05 ` syzbot
2020-04-07 1:06 ` syzbot
2020-04-07 1:27 ` Peter Xu
2020-04-07 5:26 ` syzbot
2020-04-07 1:39 ` Andrew Morton
2020-04-07 1:55 ` Peter Xu [this message]
2020-04-07 2:15 ` Andrew Morton
2020-04-07 2:42 ` Peter Xu
2020-04-07 8:27 ` Dmitry Vyukov
2020-04-07 15:59 ` Peter Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200407015535.GC48345@xz-x1 \
--to=peterx@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=bgeffon@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzbot+693dc11fcb53120b5559@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.