| Message ID | 1559544085-7502-2-git-send-email-anshuman.khandual@arm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | arm64/mm: Clean ups for do_page_fault() | expand |
On Mon, Jun 03, 2019 at 12:11:22PM +0530, Anshuman Khandual wrote: > There is an inconsistency between down_read_trylock() success and failure > paths while dealing with kernel access for non exception table areas where > it calls __do_kernel_fault(). In case of failure it just bails out without > holding mmap_sem but when it succeeds it does so while holding mmap_sem. > Fix this inconsistency by just dropping mmap_sem in success path as well. > > __do_kernel_fault() calls die_kernel_fault() which then calls show_pte(). > show_pte() in this path might become bit more unreliable without holding > mmap_sem. But there are already instances [1] in do_page_fault() where > die_kernel_fault() gets called without holding mmap_sem. show_pte() can > be made more robust independently but in a later patch. > > [1] Conditional block for (is_ttbr0_addr && is_el1_permission_fault) > > Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com> > Cc: Catalin Marinas <catalin.marinas@arm.com> > Cc: Will Deacon <will.deacon@arm.com> > Cc: Mark Rutland <mark.rutland@arm.com> > Cc: James Morse <james.morse@arm.com> > Cc: Andrey Konovalov <andreyknvl@google.com> Queued for 5.3. Thanks.
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index a30818e..dc1cf32 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -503,8 +503,10 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, */ might_sleep(); #ifdef CONFIG_DEBUG_VM - if (!user_mode(regs) && !search_exception_tables(regs->pc)) + if (!user_mode(regs) && !search_exception_tables(regs->pc)) { + up_read(&mm->mmap_sem); goto no_context; + } #endif }
There is an inconsistency between down_read_trylock() success and failure paths while dealing with kernel access for non exception table areas where it calls __do_kernel_fault(). In case of failure it just bails out without holding mmap_sem but when it succeeds it does so while holding mmap_sem. Fix this inconsistency by just dropping mmap_sem in success path as well. __do_kernel_fault() calls die_kernel_fault() which then calls show_pte(). show_pte() in this path might become bit more unreliable without holding mmap_sem. But there are already instances [1] in do_page_fault() where die_kernel_fault() gets called without holding mmap_sem. show_pte() can be made more robust independently but in a later patch. [1] Conditional block for (is_ttbr0_addr && is_el1_permission_fault) Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Andrey Konovalov <andreyknvl@google.com> --- arch/arm64/mm/fault.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)