summaryrefslogtreecommitdiff
path: root/arch
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2023-01-31 07:53:52 +0300
committerAl Viro <viro@zeniv.linux.org.uk>2023-03-02 20:31:40 +0300
commit15261678a8c2ff093ffedad730b1646d34a1716a (patch)
tree51b0d694d678e8653786acc25af6e5a3b1fc7278 /arch
parent0b92ed09cb9ffada29ca05510ef28252b6059d6d (diff)
downloadlinux-15261678a8c2ff093ffedad730b1646d34a1716a.tar.xz
parisc: fix livelock in uaccess
parisc equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Tested-by: Helge Deller <deller@gmx.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'arch')
-rw-r--r--arch/parisc/mm/fault.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 869204e97ec9..6941fdbf2517 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -308,8 +308,13 @@ good_area:
fault = handle_mm_fault(vma, address, flags, regs);
- if (fault_signal_pending(fault, regs))
+ if (fault_signal_pending(fault, regs)) {
+ if (!user_mode(regs)) {
+ msg = "Page fault: fault signal on kernel memory";
+ goto no_context;
+ }
return;
+ }
/* The fault is fully completed (including releasing mmap lock) */
if (fault & VM_FAULT_COMPLETED)