On Fri, 16 Jun 2017 00:52:31 +0200 Andrea Arcangeli <aarcange@xxxxxxxxxx> wrote: > > Can we please get that description into the changelog so that others > > can decide which kernel(s) need the fix? > > Only 4.11 is affected, pre-4.11 anon memory holes are skipped in > __get_user_pages by checking FOLL_DUMP explicitly against empty > pagetables (mm/gup.c:no_page_table()). > > Should I re-submit with this detail? Is OK thanks, I updated the changelog and queued it for 4.12. From: Andrea Arcangeli <aarcange@xxxxxxxxxx> Subject: userfaultfd: shmem: handle coredumping in handle_userfault() Anon and hugetlbfs handle FOLL_DUMP set by get_dump_page() internally to __get_user_pages(). shmem as opposed has no special FOLL_DUMP handling there so handle_mm_fault() is invoked without mmap_sem and ends up calling handle_userfault() that isn't expecting to be invoked without mmap_sem held. This makes handle_userfault() fail immediately if invoked through shmem_vm_ops->fault during coredumping and solves the problem. The side effect is a BUG_ON with no lock held triggered by the coredumping process which exits. Only 4.11 is affected, pre-4.11 anon memory holes are skipped in __get_user_pages by checking FOLL_DUMP explicitly against empty pagetables (mm/gup.c:no_page_table()). It's zero cost as we already had a check for current->flags to prevent futex to trigger userfaults during exit (PF_EXITING). Link: http://lkml.kernel.org/r/20170615214838.27429-1-aarcange@xxxxxxxxxx Signed-off-by: Andrea Arcangeli <aarcange@xxxxxxxxxx> Reported-by: "Dr. David Alan Gilbert" <dgilbert@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> [4.11+] -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
