From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Hellstrom Subject: Re: [BUG] completely bonkers use of set_need_resched + VM_FAULT_NOPAGE Date: Fri, 13 Sep 2013 10:39:50 +0200 Message-ID: <5232CF56.8060605@vmware.com> References: <20130912150645.GZ31370@twins.programming.kicks-ass.net> <5231E18D.7070306@canonical.com> <5231EF5A.7010901@vmware.com> <52323734.4070908@canonical.com> <5232B44C.9010408@vmware.com> <5232BBE1.5030509@canonical.com> <5232C2BB.9070303@vmware.com> <5232C3E8.2050501@canonical.com> <5232CB66.6000906@vmware.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Daniel Vetter Cc: Maarten Lankhorst , Peter Zijlstra , Dave Airlie , intel-gfx , dri-devel , Linux Kernel Mailing List , Ingo Molnar , Thomas Gleixner List-Id: dri-devel@lists.freedesktop.org On 09/13/2013 10:32 AM, Daniel Vetter wrote: > On Fri, Sep 13, 2013 at 10:23 AM, Thomas Hellstrom > wrote: >> As previously mentioned, copy_from_user should return -EFAULT, since the >> VMAs are marked with VM_IO. It should not recurse into fault(), so evil >> user-space looses. > I haven't put a printk in the code to prove this, but gem mmap also > sets VM_IO in drm_gem_mmap_obj. And we can very much hit our own fault > handler and deadlock .... If this is indeed true, I guess I need to accept the fact that my solution is bad. (and worse I can't blame not having my morning coffee). I'll take a deeper look. /Thomas