Uncorrected memory errors for user pages are signaled to processes
using SIGBUS or, if the error happens in a syscall, an error retval
from the syscall. The SIGBUS is documented in
Documentation/mm/hwpoison.rst#failure-recovery-modes
In execve() there is a point of no return
(bprm->point_of_no_return) after which the syscall... cannot return.
The binary loading happens after this point so if the loader triggers
a memory error reading user pages, and after control returns to
bprm_execve(), that function reacts by sending a SIGSEGV.
Set the new current->kill_on_efault flag and run pending task work to
ensure that a SIGBUS is queued in memory_failure()
Signed-off-by: Andrew Zaborowski <andrew.zaborowski@xxxxxxxxx>
---
fs/exec.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index 400731422..26c4efe1a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -68,6 +68,7 @@
#include <linux/user_events.h>
#include <linux/rseq.h>
#include <linux/ksm.h>
+#include <linux/task_work.h>
#include <linux/uaccess.h>
#include <asm/mmu_context.h>
@@ -1290,6 +1291,7 @@ int begin_new_exec(struct linux_binprm * bprm)
* Ensure all future errors are fatal.
*/
bprm->point_of_no_return = true;
+ me->kill_on_efault = true;
/*
* Make this the only thread in the thread group.
@@ -1896,6 +1898,7 @@ static int bprm_execve(struct linux_binprm *bprm)
/* execve succeeded */
current->fs->in_exec = 0;
current->in_execve = 0;
+ current->kill_on_efault = false;
rseq_execve(current);
user_events_execve(current);
acct_update_integrals(current);
@@ -1907,14 +1910,20 @@ static int bprm_execve(struct linux_binprm *bprm)
* If past the point of no return ensure the code never
* returns to the userspace process. Use an existing fatal
* signal if present otherwise terminate the process with
- * SIGSEGV.
+ * SIGSEGV. Run pending work before that in case it is
+ * terminating the process with a different signal.
*/
- if (bprm->point_of_no_return && !fatal_signal_pending(current))
- force_fatal_sig(SIGSEGV);
+ if (bprm->point_of_no_return) {
+ task_work_run();
+
+ if (!fatal_signal_pending(current))
+ force_fatal_sig(SIGSEGV);
+ }
sched_mm_cid_after_execve(current);
current->fs->in_exec = 0;
current->in_execve = 0;
+ current->kill_on_efault = false;
return retval;
}
--
2.43.0
