um: defer killing userspace on page table update failures

commit a7d48886cacf8b426e0079bca9639d2657cf2d38 upstream.

In some cases we can get to fix_range_common() with mmap_sem held,
and in others we get there without it being held. For example, we
get there with it held from sys_mprotect(), and without it held
from fork_handler().

Avoid any issues in this and simply defer killing the task until
it runs the next time. Do it on the mm so that another task that
shares the same mm can't continue running afterwards.

Cc: stable@vger.kernel.org
Fixes: 468f65976a8d ("um: Fix hung task in fix_range_common()")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/um/include/shared/skas/mm_id.h b/arch/um/include/shared/skas/mm_id.h
index 4337b4c..e82e203 100644 (file)
--- a/arch/um/include/shared/skas/mm_id.h
+++ b/arch/um/include/shared/skas/mm_id.h
@@ -12,6 +12,7 @@ struct mm_id {
                int pid;
        } u;
        unsigned long stack;
+       int kill;
 };
 
 #endif

diff --git a/arch/um/kernel/tlb.c b/arch/um/kernel/tlb.c
index 89468da..5be1b0d 100644 (file)
--- a/arch/um/kernel/tlb.c
+++ b/arch/um/kernel/tlb.c
@@ -352,12 +352,11 @@ void fix_range_common(struct mm_struct *mm, unsigned long start_addr,
 
        /* This is not an else because ret is modified above */
        if (ret) {
+               struct mm_id *mm_idp = &current->mm->context.id;
+
                printk(KERN_ERR "fix_range_common: failed, killing current "
                       "process: %d\n", task_tgid_vnr(current));
-               /* We are under mmap_lock, release it such that current can terminate */
-               mmap_write_unlock(current->mm);
-               force_sig(SIGKILL);
-               do_signal(&current->thread.regs);
+               mm_idp->kill = 1;
        }
 }
 

diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index 4fb877b..94a7c41 100644 (file)
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -249,6 +249,7 @@ static int userspace_tramp(void *stack)
 }
 
 int userspace_pid[NR_CPUS];
+int kill_userspace_mm[NR_CPUS];
 
 /**
  * start_userspace() - prepare a new userspace process
@@ -342,6 +343,8 @@ void userspace(struct uml_pt_regs *regs, unsigned long *aux_fp_regs)
        interrupt_end();
 
        while (1) {
+               if (kill_userspace_mm[0])
+                       fatal_sigsegv();
 
                /*
                 * This can legitimately fail if the process loads a
@@ -650,4 +653,5 @@ void reboot_skas(void)
 void __switch_mm(struct mm_id *mm_idp)
 {
        userspace_pid[0] = mm_idp->u.pid;
+       kill_userspace_mm[0] = mm_idp->kill;
 }