linux-kernel - [PATCH] mm/fs: don't keep pages when receiving a pending SIGKILL in __get_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <52D65568.6080106@huawei.com>
Date:	Wed, 15 Jan 2014 17:31:20 +0800
From:	Xishi Qiu <qiuxishi@...wei.com>
To:	Li Zefan <lizefan@...wei.com>, <robin.yb@...wei.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Mel Gorman <mgorman@...e.de>, <riel@...hat.com>
CC:	Xishi Qiu <qiuxishi@...wei.com>, <linux-fsdevel@...r.kernel.org>,
	Linux MM <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH] mm/fs: don't keep pages when receiving a pending SIGKILL
 in __get_user_pages()

In the process IO direction, dio_refill_pages will call get_user_pages_fast 
to map the page from user space. If ret is less than 0 and IO is write, the 
function will create a zero page to fill data. This may work for some file 
system, but in some device operate we prefer whole write or fail, not half 
data half zero, e.g. fs metadata, like inode, identy.
This happens often when kill a process which is doing direct IO. Consider 
the following cases, the process A is doing IO process, may enter __get_user_pages 
function, if other processes send process A SIG_KILL, A will enter the 
following branches 
		/*
		 * If we have a pending SIGKILL, don't keep faulting
		 * pages and potentially allocating memory.
		 */
		if (unlikely(fatal_signal_pending(current)))
			return i ? i : -ERESTARTSYS;
Return current pages. direct IO will write the pages, the subsequent pages 
which can’t get will use zero page instead. 
This patch will modify this judgment, if receive SIG_KILL, release pages and 
return an error. Direct IO will find no blocks_available and return error 
direct, rather than half IO data and half zero page.

Signed-off-by: Xishi Qiu <qiuxishi@...wei.com>
Signed-off-by: Bin Yang <robin.yb@...wei.com>
---
 mm/memory.c |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 6768ce9..0568faa 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1799,8 +1799,14 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 			 * If we have a pending SIGKILL, don't keep faulting
 			 * pages and potentially allocating memory.
 			 */
-			if (unlikely(fatal_signal_pending(current)))
-				return i ? i : -ERESTARTSYS;
+			if (unlikely(fatal_signal_pending(current))) {
+				int j;
+				for (j = 0; j < i; j++) {
+					put_page(pages[j]);
+					pages[j] = NULL;
+				}
+				return  -ERESTARTSYS;
+			}
 
 			cond_resched();
 			while (!(page = follow_page_mask(vma, start,
-- 
1.7.1


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/