Commit d14f6fce authored Sep 16, 2015 by Jay Cornwall Committed by Joerg Roedel Oct 15, 2015

iommu/amd: Fix BUG when faulting a PROT_NONE VMA



handle_mm_fault indirectly triggers a BUG in do_numa_page
when given a VMA without read/write/execute access. Check
this condition in do_fault.

do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page

  mm/memory.c
  3147  static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
  ....
  3159  /* A PROT_NONE fault should not end up here */
  3160  BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));

Signed-off-by: Jay Cornwall <jay@jcornwall.me>
Cc: <stable@vger.kernel.org> # v4.1+
Signed-off-by: Joerg Roedel <jroedel@suse.de>

parent 5adad991

drivers/iommu/amd_iommu_v2.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -516,6 +516,13 @@ static void do_fault(struct work_struct *work)
		goto out;
		}

		if (!(vma->vm_flags & (VM_READ \| VM_EXEC \| VM_WRITE))) {
		/* handle_mm_fault would BUG_ON() */
		up_read(&mm->mmap_sem);
		handle_fault_error(fault);
		goto out;
		}

		ret = handle_mm_fault(mm, vma, address, write);
		if (ret & VM_FAULT_ERROR) {
		/* failed to service fault */