| Message ID | 20200408014010.80428-3-peterx@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | mm: Two small fixes for recent syzbot reports | expand |
diff --git a/mm/gup.c b/mm/gup.c index da3e03185144..1f9a9b3a5869 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1328,7 +1328,6 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk, if (fatal_signal_pending(current)) break; - *locked = 1; ret = down_read_killable(&mm->mmap_sem); if (ret) { BUG_ON(ret > 0); @@ -1337,6 +1336,7 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk, break; } + *locked = 1; ret = __get_user_pages(tsk, mm, start, 1, flags | FOLL_TRIED, pages, NULL, locked); if (!*locked) {
It's definitely incorrect to mark the lock as taken even if down_read_killable() failed. It's overlooked when we switched from down_read() to down_read_killable() because down_read() won't fail while down_read_killable() could. Reported-by: syzbot+a8c70b7f3579fc0587dc@syzkaller.appspotmail.com Fixes: 71335f37c5e8 ("mm/gup: allow to react to fatal signals") Signed-off-by: Peter Xu <peterx@redhat.com> --- mm/gup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)