The userfaultfd code sets the faulting task's state to TASK_KILLABLE for faults
originating from kernel accesses, which prevents the task being frozen during a
hibernate operation. For example, setting a userfaultfd region to trigger on
the signal stack leads to a task that requires a fatal signal in order to exit
after the kernel has failed to push a sigframe for a prior non-fatal signal.
Such a task causes hibernation to fail as follows and can be achieved without
additional privilege:
Freezing user space processes ...
Freezing of tasks failed after 20.007 seconds (1 tasks refusing to freeze, wq_busy=0):
uaccess-repro D 0 11213 9853 0x00000004
Call Trace:
__schedule+0x245/0x880
schedule+0x36/0x80
handle_userfault+0x28f/0x670
? userfaultfd_ctx_get+0x40/0x40
__handle_mm_fault+0xf92/0xfa0
handle_mm_fault+0xd8/0x240
__do_page_fault+0x23f/0x4c0
do_page_fault+0x22/0x30
page_fault+0x28/0x30
RIP: 0010:__clear_user+0x25/0x50
RSP: 0018:ffffb098029b3d70 EFLAGS: 00050202
RAX: 0000000000000000 RBX: 00007f5830336c80 RCX: 0000000000000008
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 00007f5830336e80
RBP: ffffb098029b3d70 R08: 0000000000000344 R09: 000000000000000c
R10: ffffb098029b3d37 R11: ffff92b58c0cc380 R12: ffff92b58c0cc380
R13: 00007f5830336c80 R14: ffffb098029b3e18 R15: ffff92b58c0ccdf8
copy_fpstate_to_sigframe+0x91/0x1f0
get_sigframe.isra.13.constprop.14+0x1aa/0x1d0
do_signal+0x1c4/0x740
? SYSC_kill+0xeb/0x1a0
? alloc_file+0x1d/0xc0
exit_to_usermode_loop+0x80/0xd0
syscall_return_slowpath+0x59/0x60
entry_SYSCALL_64_fastpath+0xa7/0xa9
This patch fixes the problem by informing the freezer code that the task does
not require to be frozen when in an uninterruptible state.
Cc: Mark Rutland <mark.rutland@xxxxxxx>
Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Andrea Arcangeli <aarcange@xxxxxxxxxx>
Cc: "Rafael J. Wysocki" <rjw@xxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Will Deacon <will.deacon@xxxxxxx>
---
fs/userfaultfd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index ef4b48d1ea42..974f2dd4e711 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -29,6 +29,7 @@
#include <linux/ioctl.h>
#include <linux/security.h>
#include <linux/hugetlb.h>
+#include <linux/freezer.h>
static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
@@ -481,6 +482,7 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
(return_to_userland ? !signal_pending(current) :
!fatal_signal_pending(current)))) {
wake_up_poll(&ctx->fd_wqh, POLLIN);
+ freezer_do_not_count();
schedule();
ret |= VM_FAULT_MAJOR;
@@ -504,8 +506,10 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
(return_to_userland ? signal_pending(current) :
fatal_signal_pending(current)))
break;
+
schedule();
}
+ freezer_count();
}
__set_current_state(TASK_RUNNING);
--
2.1.4