linux-kernel - [git pull] VM_FAULT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZAP6IvbWaNjPthCq@ZenIV>
Date:   Sun, 5 Mar 2023 02:10:42 +0000
From:   Al Viro <viro@...iv.linux.org.uk>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org, linux-arch@...r.kernel.org
Subject: [git pull] VM_FAULT_RETRY fixes

The following changes since commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c:

  Linux 6.2 (2023-02-19 14:24:22 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git tags/pull-fixes

for you to fetch changes up to caa82ae7ef52b7cf5f80a2b2fbcbdbcfd16426cc:

  openrisc: fix livelock in uaccess (2023-03-02 12:32:44 -0500)

----------------------------------------------------------------
VM_FAULT_RETRY fixes

Some of the page fault handlers do not deal with the following case
correctly:
	* handle_mm_fault() has returned VM_FAULT_RETRY
	* there is a pending fatal signal
	* fault had happened in kernel mode
Correct action in such case is not "return unconditionally" - fatal
signals are handled only upon return to userland and something like
copy_to_user() would end up retrying the faulting instruction and
triggering the same fault again and again.

What we need to do in such case is to make the caller to treat that
as failed uaccess attempt - handle exception if there is an exception
handler for faulting instruction or oops if there isn't one.

Over the years some architectures had been fixed and now are handling
that case properly; some still do not.  This series should fix the
remaining ones.

Status:
	m68k, riscv, hexagon, parisc: tested/acked by maintainers.
	alpha, sparc32, sparc64: tested locally - bug has been
reproduced on the unpatched kernel and verified to be fixed by
this series.
	ia64, microblaze, nios2, openrisc: build, but otherwise
completely untested.

Signed-off-by: Al Viro <viro@...iv.linux.org.uk>

----------------------------------------------------------------
Al Viro (10):
      m68k: fix livelock in uaccess
      riscv: fix livelock in uaccess
      hexagon: fix livelock in uaccess
      parisc: fix livelock in uaccess
      alpha: fix livelock in uaccess
      sparc: fix livelock in uaccess
      ia64: fix livelock in uaccess
      microblaze: fix livelock in uaccess
      nios2: fix livelock in uaccess
      openrisc: fix livelock in uaccess

 arch/alpha/mm/fault.c      | 5 ++++-
 arch/hexagon/mm/vm_fault.c | 5 ++++-
 arch/ia64/mm/fault.c       | 5 ++++-
 arch/m68k/mm/fault.c       | 5 ++++-
 arch/microblaze/mm/fault.c | 5 ++++-
 arch/nios2/mm/fault.c      | 5 ++++-
 arch/openrisc/mm/fault.c   | 5 ++++-
 arch/parisc/mm/fault.c     | 7 ++++++-
 arch/riscv/mm/fault.c      | 5 ++++-
 arch/sparc/mm/fault_32.c   | 5 ++++-
 arch/sparc/mm/fault_64.c   | 7 ++++++-
 11 files changed, 48 insertions(+), 11 deletions(-)