Commit 169cc12f authored by Peter Xu's avatar Peter Xu Committed by Cheng Jian
Browse files

mm/mempolicy: Allow lookup_node() to handle fatal signal 



mainline inclusion
from mainline-v5.7-rc1
commit ba841078
category: bugfix
bugzilla: 47439
CVE: NA
---------------------------

lookup_node() uses gup to pin the page and get node information.  It
checks against ret>=0 assuming the page will be filled in.  However it's
also possible that gup will return zero, for example, when the thread is
quickly killed with a fatal signal.  Teach lookup_node() to gracefully
return an error -EFAULT if it happens.

Meanwhile, initialize "page" to NULL to avoid potential risk of
exploiting the pointer.

Fixes: 4426e945 ("mm/gup: allow VM_FAULT_RETRY for multiple times")
Reported-by: default avatar <syzbot+693dc11fcb53120b5559@syzkaller.appspotmail.com>
Signed-off-by: default avatarPeter Xu <peterx@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
 Conflicts:
	mm/mempolicy.c
Signed-off-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Reviewed-by: default avatarJing Xiangfeng <jingxiangfeng@huawei.com>
Reviewed-by: default avatarKefeng&nbsp; Wang <wangkefeng.wang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarCheng Jian <cj.chengjian@huawei.com>
parent bcfd7200

mm/mempolicy.c

+5 −2
Original line number Diff line number Diff line
@@ -897,11 +897,14 @@ static void get_policy_nodemask(struct mempolicy *p, nodemask_t *nodes) 


static int lookup_node(unsigned long addr)

{

	struct page *p;

	struct page *p = NULL;

	int err;



	err = get_user_pages(addr & PAGE_MASK, 1, 0, &p, NULL);

	if (err >= 0) {

	if (err == 0) {

		/* E.g. GUP interrupted by fatal signal */

		err = -EFAULT;

	} else if (err > 0) {

		err = page_to_nid(p);

		put_page(p);

	}