Hi, Mark:
2017-11-27 21:51 GMT+08:00 Mark Rutland <mark.rutland@xxxxxxx>:
> Hi,
>
> On Mon, Nov 27, 2017 at 08:27:53PM +0800, Greentime Hu wrote:
>> +void do_page_fault(unsigned long entry, unsigned long addr,
>> + unsigned int error_code, struct pt_regs *regs)
>> +{
>
>> + /*
>> + * As per x86, we may deadlock here. However, since the kernel only
>> + * validly references user space from well defined areas of the code,
>> + * we can bug out early if this is from code which shouldn't.
>> + */
>> + if (unlikely(!down_read_trylock(&mm->mmap_sem))) {
>> + if (!user_mode(regs) &&
>> + !search_exception_tables(instruction_pointer(regs)))
>> + goto no_context;
>> +retry:
>> + down_read(&mm->mmap_sem);
>> + } else {
>> + /*
>> + * The above down_read_trylock() might have succeeded in which
>> + * case, we'll have missed the might_sleep() from down_read().
>> + */
>> + might_sleep();
>> + if (IS_ENABLED(CONFIG_DEBUG_VM)) {
>> + if (!user_mode(regs) &&
>> + !search_exception_tables(instruction_pointer(regs)))
>> + goto no_context;
>> + }
>> + }
>
>> + fault = handle_mm_fault(vma, addr, flags);
>> +
>> + /*
>> + * If we need to retry but a fatal signal is pending, handle the
>> + * signal first. We do not need to release the mmap_sem because it
>> + * would already be released in __lock_page_or_retry in mm/filemap.c.
>> + */
>> + if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
>> + return;
>
> I believe you can get stuck in a livelock here (with an unkillable
> task), if a uaccess primitive tries to access a region protected by a
> userfaultfd. Please see:
>
> https://lkml.kernel.org/r/1499782590-31366-1-git-send-email-mark.rutland@xxxxxxx
>
> ... for details and a test case.
>
Thanks for your teatcase and patch. It works.
I will apply it to the next version patch.
