• Mike Rapoport's avatar
    mm/gup: continue VM_FAULT_RETRY processing even for pre-faults · df17277b
    Mike Rapoport authored
    When get_user_pages*() is called with pages = NULL, the processing of
    VM_FAULT_RETRY terminates early without actually retrying to fault-in all
    the pages.
    If the pages in the requested range belong to a VMA that has userfaultfd
    registered, handle_userfault() returns VM_FAULT_RETRY *after* user space
    has populated the page, but for the gup pre-fault case there's no actual
    retry and the caller will get no pages although they are present.
    This issue was uncovered when running post-copy memory restore in CRIU
    after d9c9ce34 ("x86/fpu: Fault-in user stack if
    copy_fpstate_to_sigframe() fails").
    After this change, the copying of FPU state to the sigframe switched from
    copy_to_user() variants which caused a real page fault to get_user_pages()
    with pages parameter set to NULL.
    In post-copy mode of CRIU, the destination memory is managed with
    userfaultfd and lack of the retry for pre-fault case in get_user_pages()
    causes a crash of the restored process.
    Making the pre-fault behavior of get_user_pages() the same as the "normal"
    one fixes the issue.
    Link: http://lkml.kernel.org/r/1557844195-18882-1-git-send-email-rppt@linux.ibm.com
    Fixes: d9c9ce34
     ("x86/fpu: Fault-in user stack if copy_fpstate_to_sigframe() fails")
    Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
    Tested-by: Andrei Vagin <avagin@gmail.com> [https://travis-ci.org/avagin/linux/builds/533184940
    Tested-by: default avatarHugh Dickins <hughd@google.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Pavel Machek <pavel@ucw.cz>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
gup.c 60.9 KB