This is a note to let you know that I've just added the patch titled userfaultfd_zeropage: return -ENOSPC in case mm has gone to the 4.12-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: userfaultfd_zeropage-return-enospc-in-case-mm-has-gone.patch and it can be found in the queue-4.12 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 9d95aa4bada24be35bb94827a55e1d6e243d866e Mon Sep 17 00:00:00 2001 From: Mike Rapoport <rppt@xxxxxxxxxxxxxxxxxx> Date: Wed, 2 Aug 2017 13:32:15 -0700 Subject: userfaultfd_zeropage: return -ENOSPC in case mm has gone From: Mike Rapoport <rppt@xxxxxxxxxxxxxxxxxx> commit 9d95aa4bada24be35bb94827a55e1d6e243d866e upstream. In the non-cooperative userfaultfd case, the process exit may race with outstanding mcopy_atomic called by the uffd monitor. Returning -ENOSPC instead of -EINVAL when mm is already gone will allow uffd monitor to distinguish this case from other error conditions. Unfortunately I overlooked userfaultfd_zeropage when updating userfaultd_copy(). Link: http://lkml.kernel.org/r/1501136819-21857-1-git-send-email-rppt@xxxxxxxxxxxxxxxxxx Fixes: 96333187ab162 ("userfaultfd_copy: return -ENOSPC in case mm has gone") Signed-off-by: Mike Rapoport <rppt@xxxxxxxxxxxxxxxxxx> Cc: Andrea Arcangeli <aarcange@xxxxxxxxxx> Cc: "Dr. David Alan Gilbert" <dgilbert@xxxxxxxxxx> Cc: Pavel Emelyanov <xemul@xxxxxxxxxxxxx> Cc: Michal Hocko <mhocko@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/userfaultfd.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -1645,6 +1645,8 @@ static int userfaultfd_zeropage(struct u ret = mfill_zeropage(ctx->mm, uffdio_zeropage.range.start, uffdio_zeropage.range.len); mmput(ctx->mm); + } else { + return -ENOSPC; } if (unlikely(put_user(ret, &user_uffdio_zeropage->zeropage))) return -EFAULT; Patches currently in stable-queue which might be from rppt@xxxxxxxxxxxxxxxxxx are queue-4.12/userfaultfd-non-cooperative-flush-event_wqh-at-release-time.patch queue-4.12/userfaultfd_zeropage-return-enospc-in-case-mm-has-gone.patch queue-4.12/userfaultfd-non-cooperative-notify-about-unmap-of-destination-during-mremap.patch