raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 01:49:46 +00:00
Code Issues Projects Releases Wiki Activity

iommu/amd: Fix BUG when faulting a PROT_NONE VMA

Browse Source 
commit d14f6fced5 upstream.

handle_mm_fault indirectly triggers a BUG in do_numa_page
when given a VMA without read/write/execute access. Check
this condition in do_fault.

do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page

  mm/memory.c
  3147  static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
  ....
  3159  /* A PROT_NONE fault should not end up here */
  3160  BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));

Signed-off-by: Jay Cornwall <jay@jcornwall.me>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jay Cornwall
2015-09-16 14:10:03 -05:00
committed by Greg Kroah-Hartman
parent 1fe434c0ef
commit 75deee3f94
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/iommu/amd_iommu_v2.c
View File

@@ -508,6 +508,13 @@ static void do_fault(struct work_struct *work)
goto out; goto out;
} }
if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) {
/* handle_mm_fault would BUG_ON() */
up_read(&mm->mmap_sem);
handle_fault_error(fault);
goto out;
}
ret = handle_mm_fault(mm, vma, address, write); ret = handle_mm_fault(mm, vma, address, write);
if (ret & VM_FAULT_ERROR) { if (ret & VM_FAULT_ERROR) {
/* failed to service fault */ /* failed to service fault */