Commit df297bfa authored by Gerald Schaefer's avatar Gerald Schaefer Committed by Huang Xiaojia
Browse files

s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() 

mainline inclusion
from mainline-v6.11-rc1
commit df39038cd89525d465c2c8827eb64116873f141a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEF2
CVE: CVE-2024-41021

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=df39038cd89525d465c2c8827eb64116873f141a



--------------------------------

There is no support for HWPOISON, MEMORY_FAILURE, or ARCH_HAS_COPY_MC on
s390. Therefore we do not expect to see VM_FAULT_HWPOISON in
do_exception().

However, since commit af19487f ("mm: make PTE_MARKER_SWAPIN_ERROR more
general"), it is possible to see VM_FAULT_HWPOISON in combination with
PTE_MARKER_POISONED, even on architectures that do not support HWPOISON
otherwise. In this case, we will end up on the BUG() in do_exception().

Fix this by treating VM_FAULT_HWPOISON the same as VM_FAULT_SIGBUS, similar
to x86 when MEMORY_FAILURE is not configured. Also print unexpected fault
flags, for easier debugging.

Note that VM_FAULT_HWPOISON_LARGE is not expected, because s390 cannot
support swap entries on other levels than PTE level.

Cc: stable@vger.kernel.org # 6.6+
Fixes: af19487f ("mm: make PTE_MARKER_SWAPIN_ERROR more general")
Reported-by: default avatarYunseong Kim <yskelg@gmail.com>
Tested-by: default avatarYunseong Kim <yskelg@gmail.com>
Acked-by: default avatarAlexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: default avatarGerald Schaefer <gerald.schaefer@linux.ibm.com>
Message-ID: <20240715180416.3632453-1-gerald.schaefer@linux.ibm.com>
Signed-off-by: default avatarVasily Gorbik <gor@linux.ibm.com>
Conflicts:
	arch/s390/mm/fault.c
[huangxiaojia adapt context conflicts.]
Signed-off-by: default avatarHuang Xiaojia <huangxiaojia2@huawei.com>
parent 46dd005d

arch/s390/mm/fault.c

+4 −2
Original line number Diff line number Diff line
@@ -331,14 +331,16 @@ static noinline void do_fault_error(struct pt_regs *regs, vm_fault_t fault) 
				do_no_context(regs, fault);

			else

				do_sigsegv(regs, SEGV_MAPERR);

		} else if (fault & VM_FAULT_SIGBUS) {

		} else if (fault & (VM_FAULT_SIGBUS | VM_FAULT_HWPOISON)) {

			/* Kernel mode? Handle exceptions or die */

			if (!user_mode(regs))

				do_no_context(regs, fault);

			else

				do_sigbus(regs);

		} else

		} else {

			pr_emerg("Unexpected fault flags: %08x\n", fault);

			BUG();

		}

		break;

	}

}