Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2e97f02 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Greg Kroah-Hartman
Browse files

userfaultfd: disable irqs when taking the waitqueue lock 

commit ae62c16e105a869524afcf8a07ee85c5ae5d0479 upstream.

userfaultfd contains howe-grown locking of the waitqueue lock, and does
not disable interrupts.  This relies on the fact that no one else takes it
from interrupt context and violates an invariat of the normal waitqueue
locking scheme.  With aio poll it is easy to trigger other locks that
disable interrupts (or are called from interrupt context).

Link: http://lkml.kernel.org/r/20181018154101.18750-1-hch@lst.de


Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Cc: <stable@vger.kernel.org>	[4.19.x]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 30391e41

fs/userfaultfd.c

+4 −4
Original line number Diff line number Diff line
@@ -1026,7 +1026,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait, 
	struct userfaultfd_ctx *fork_nctx = NULL;



	/* always take the fd_wqh lock before the fault_pending_wqh lock */

	spin_lock(&ctx->fd_wqh.lock);

	spin_lock_irq(&ctx->fd_wqh.lock);

	__add_wait_queue(&ctx->fd_wqh, &wait);

	for (;;) {

		set_current_state(TASK_INTERRUPTIBLE);
@@ -1112,13 +1112,13 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait, 
			ret = -EAGAIN;

			break;

		}

		spin_unlock(&ctx->fd_wqh.lock);

		spin_unlock_irq(&ctx->fd_wqh.lock);

		schedule();

		spin_lock(&ctx->fd_wqh.lock);

		spin_lock_irq(&ctx->fd_wqh.lock);

	}

	__remove_wait_queue(&ctx->fd_wqh, &wait);

	__set_current_state(TASK_RUNNING);

	spin_unlock(&ctx->fd_wqh.lock);

	spin_unlock_irq(&ctx->fd_wqh.lock);



	if (!ret && msg->event == UFFD_EVENT_FORK) {

		ret = resolve_userfault_fork(ctx, fork_nctx, msg);