The commit b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()") reviewed
the way the error path is managed in __do_page_fault() but it was a bit too
agressive when handling a case by returning without releasing the mmap_sem.
By the way, replacing current->mm->mmap_sem by mm->mmap_sem as mm is set to
current->mm.
Fixes: b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()")
Cc: Benjamin Herrenschmidt <[email protected]>
Signed-off-by: Laurent Dufour <[email protected]>
---
arch/powerpc/mm/fault.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 4797d08581ce..f799ccf37d27 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -521,10 +521,11 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address,
* User mode? Just return to handle the fatal exception otherwise
* return to bad_page_fault
*/
+ up_read(&mm->mmap_sem);
return is_user ? 0 : SIGBUS;
}
- up_read(¤t->mm->mmap_sem);
+ up_read(&mm->mmap_sem);
if (unlikely(fault & VM_FAULT_ERROR))
return mm_fault_error(regs, address, fault);
--
2.7.4
On Thu, 07 Sep 2017, Laurent Dufour wrote:
>The commit b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()") reviewed
>the way the error path is managed in __do_page_fault() but it was a bit too
>agressive when handling a case by returning without releasing the mmap_sem.
>
>By the way, replacing current->mm->mmap_sem by mm->mmap_sem as mm is set to
>current->mm.
>
>Fixes: b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()")
>Cc: Benjamin Herrenschmidt <[email protected]>
>Signed-off-by: Laurent Dufour <[email protected]>
>---
> arch/powerpc/mm/fault.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
>index 4797d08581ce..f799ccf37d27 100644
>--- a/arch/powerpc/mm/fault.c
>+++ b/arch/powerpc/mm/fault.c
But... here:
/*
* If we need to retry the mmap_sem has already been released,
* and if there is a fatal signal pending there is no guarantee
* that we made any progress. Handle this case first.
*/
>@@ -521,10 +521,11 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address,
> * User mode? Just return to handle the fatal exception otherwise
> * return to bad_page_fault
> */
>+ up_read(&mm->mmap_sem);
> return is_user ? 0 : SIGBUS;
> }
Per the above comment, for that case handle_mm_fault()
has already released mmap_sem. The same occurs in x86,
for example.
Thanks,
Davidlohr
On 07/09/2017 22:51, Davidlohr Bueso wrote:
> On Thu, 07 Sep 2017, Laurent Dufour wrote:
>
>> The commit b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()") reviewed
>> the way the error path is managed in __do_page_fault() but it was a bit too
>> agressive when handling a case by returning without releasing the mmap_sem.
>>
>> By the way, replacing current->mm->mmap_sem by mm->mmap_sem as mm is set to
>> current->mm.
>>
>> Fixes: b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()")
>> Cc: Benjamin Herrenschmidt <[email protected]>
>> Signed-off-by: Laurent Dufour <[email protected]>
>> ---
>> arch/powerpc/mm/fault.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
>> index 4797d08581ce..f799ccf37d27 100644
>> --- a/arch/powerpc/mm/fault.c
>> +++ b/arch/powerpc/mm/fault.c
>
> But... here:
>
> /*
> * If we need to retry the mmap_sem has already been released,
> * and if there is a fatal signal pending there is no guarantee
> * that we made any progress. Handle this case first.
> */
>
>> @@ -521,10 +521,11 @@ static int __do_page_fault(struct pt_regs *regs,
>> unsigned long address,
>> * User mode? Just return to handle the fatal exception otherwise
>> * return to bad_page_fault
>> */
>> + up_read(&mm->mmap_sem);
>> return is_user ? 0 : SIGBUS;
>> }
>
> Per the above comment, for that case handle_mm_fault()
> has already released mmap_sem. The same occurs in x86,
> for example.
Oops, my bad.
Please forget about this stupid patch...