On Tue 07-04-20 21:40:09, Peter Xu wrote:
> lookup_node() uses gup to pin the page and get node information. It
> checks against ret>=0 assuming the page will be filled in. However
> it's also possible that gup will return zero, for example, when the
> thread is quickly killed with a fatal signal. Teach lookup_node() to
> gracefully return an error -EFAULT if it happens.
>
> Meanwhile, initialize "page" to NULL to avoid potential risk of
> exploiting the pointer.
>
> Reported-by: syzbot+693dc11fcb53120b5559@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 4426e945df58 ("mm/gup: allow VM_FAULT_RETRY for multiple times")
I am not familiar with thic commit but shouldn't gup return ERESTARTSYS
on a fatal signal?
--
Michal Hocko
SUSE Labs
