Commit 93c7b0bc authored Jul 06, 2015 by Kirill A. Shutemov Committed by Min Chong Nov 22, 2016

BACKPORT: mm: avoid setting up anonymous pages into file mapping



(cherry picked from commit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d)

Reading page fault handler code I've noticed that under right
circumstances kernel would map anonymous pages into file mappings: if
the VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated
on ->mmap(), kernel would handle page fault to not populated pte with
do_anonymous_page().

Let's change page fault handler to use do_anonymous_page() only on
anonymous VMA (->vm_ops == NULL) and make sure that the VMA is not
shared.

For file mappings without vm_ops->fault() or shred VMA without vm_ops,
page fault on pte_none() entry would lead to SIGBUS.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I451f90075ddf0c3592543e4fe30eed4c38348d49
Bug: 32460277

parent 1b68d04e

mm/memory.c

+10 −4

Original line number	Diff line number	Diff line
		@@ -2636,6 +2636,10 @@ static int do_anonymous_page(struct mm_struct mm, struct vm_area_struct vma,

		pte_unmap(page_table);

		/* File mapping without ->vm_ops ? */
		if (vma->vm_flags & VM_SHARED)
		return VM_FAULT_SIGBUS;

		/* Check if we need to add a guard page to the stack */
		if (check_stack_guard_page(vma, address) < 0)
		return VM_FAULT_SIGBUS;
		@@ -3040,6 +3044,9 @@ static int do_linear_fault(struct mm_struct mm, struct vm_area_struct vma,
		- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;

		pte_unmap(page_table);
		/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
		if (!vma->vm_ops->fault)
		return VM_FAULT_SIGBUS;
		if (!(flags & FAULT_FLAG_WRITE))
		return do_read_fault(mm, vma, address, pmd, pgoff, flags,
		orig_pte);
		@@ -3205,11 +3212,10 @@ static int handle_pte_fault(struct mm_struct *mm,
		entry = ACCESS_ONCE(*pte);
		if (!pte_present(entry)) {
		if (pte_none(entry)) {
		if (vma->vm_ops) {
		if (likely(vma->vm_ops->fault))
		if (vma->vm_ops)
		return do_linear_fault(mm, vma, address,
		pte, pmd, flags, entry);
		}

		return do_anonymous_page(mm, vma, address,
		pte, pmd, flags);
		}