On Wed, 10 May 2023, Matthew Wilcox wrote:
On Tue, May 09, 2023 at 09:42:44PM -0700, Hugh Dickins wrote:
diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
index e4c2677cc1e9..2f6163f05e93 100644
--- a/arch/arm/lib/uaccess_with_memcpy.c
+++ b/arch/arm/lib/uaccess_with_memcpy.c
@@ -74,6 +74,9 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
return 0;
pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl);
+ if (unlikely(!pte))
+ return 0;
Failing seems like the wrong thig to do if we transitioned from a PTE
to PMD here? Looks to me like we should goto a new label right after
the 'pmd = pmd_offset(pud, addr);', no?
I'm pretty sure it's right as is; but probably more by luck than care -
I do not think I studied this code as closely as you have now made me do;
and it's clear that this is a piece of code where rare transient issues
could come up, and must be handled correctly. Thank you for making me
look again.
The key is in the callers of pin_page_for_write(): __copy_to_user_memcpy()
and __clear_user_memset(). They're doing "while (!pin_page_for_write())"
loops - they hope for the fast path of getting pte_lock or pmd_lock on
the page, and doing a __memcpy() or __memset() to the user address; but
if anything goes "wrong", a __put_user() to fault in the page (or fail)
then pin_page_for_write() again.
"if (unlikely(!pte)) return 0" says that the expected fast path did not
succeed, so please __put_user() and have another go.
It is somewhere I could have done a "goto again", but that would be
superfluous when it's already designed that way at the outer level.
Hugh
