diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2023-01-30 23:55:52 -0500 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2023-03-02 12:30:15 -0500 |
| commit | d835eb3a57de50d16dd4a6b53f95dbc2bfa8ef48 (patch) | |
| tree | d027d106b51591b8d2b6eedc82b19368fc27ef93 /arch | |
| parent | bd75497a77ccae9a5e1b0f1a3fa8283d67b21f4c (diff) | |
riscv: fix livelock in uaccess
riscv equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling"
If e.g. get_user() triggers a page fault and a fatal signal is caught, we might
end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything
to page tables. In such case we must *not* return to the faulting insn -
that would repeat the entire thing without making any progress; what we need
instead is to treat that as failed (user) memory access.
Tested-by: Björn Töpel <bjorn@kernel.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/riscv/mm/fault.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c index d86f7cebd4a7..c91d85349d39 100644 --- a/arch/riscv/mm/fault.c +++ b/arch/riscv/mm/fault.c @@ -324,8 +324,11 @@ good_area: * signal first. We do not need to release the mmap_lock because it * would already be released in __lock_page_or_retry in mm/filemap.c. */ - if (fault_signal_pending(fault, regs)) + if (fault_signal_pending(fault, regs)) { + if (!user_mode(regs)) + no_context(regs, addr); return; + } /* The fault is fully completed (including releasing mmap lock) */ if (fault & VM_FAULT_COMPLETED) |