Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1033746AbbKFU1M (ORCPT ); Fri, 6 Nov 2015 15:27:12 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:47661 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1033159AbbKFTb7 (ORCPT ); Fri, 6 Nov 2015 14:31:59 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jay Cornwall , Joerg Roedel Subject: [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA Date: Fri, 6 Nov 2015 11:22:10 -0800 Message-Id: <20151106192205.899033919@linuxfoundation.org> X-Mailer: git-send-email 2.6.2 In-Reply-To: <20151106192205.351595349@linuxfoundation.org> References: <20151106192205.351595349@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1556 Lines: 51 4.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jay Cornwall commit d14f6fced5f9360edca5a1325ddb7077aab1203b upstream. handle_mm_fault indirectly triggers a BUG in do_numa_page when given a VMA without read/write/execute access. Check this condition in do_fault. do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page mm/memory.c 3147 static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, .... 3159 /* A PROT_NONE fault should not end up here */ 3160 BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))); Signed-off-by: Jay Cornwall Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman --- drivers/iommu/amd_iommu_v2.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/iommu/amd_iommu_v2.c +++ b/drivers/iommu/amd_iommu_v2.c @@ -508,6 +508,13 @@ static void do_fault(struct work_struct goto out; } + if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) { + /* handle_mm_fault would BUG_ON() */ + up_read(&mm->mmap_sem); + handle_fault_error(fault); + goto out; + } + ret = handle_mm_fault(mm, vma, address, write); if (ret & VM_FAULT_ERROR) { /* failed to service fault */ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/