Andrea Arcangeli ee9be99630 userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE ...

[ Upstream commit 6bbc4a4144b1a69743022ac68dfaf6e7d993abb9 ]

__do_fault assumes vmf->page has been initialized and is valid if
VM_FAULT_NOPAGE is not returned by vma->vm_ops->fault(vma, vmf).

handle_userfault() in turn should return VM_FAULT_NOPAGE if it doesn't
return VM_FAULT_SIGBUS or VM_FAULT_RETRY (the other two possibilities).

This VM_FAULT_NOPAGE case is only invoked when signal are pending and it
didn't matter for anonymous memory before.  It only started to matter
since shmem was introduced.  hugetlbfs also takes a different path and
doesn't exercise __do_fault.

Link: http://lkml.kernel.org/r/20170228154201.GH5816@redhat.com
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-12-20 10:04:53 +01:00

..

9p

fs/9p: Compare qid.path in v9fs_test_inode

2017-11-30 08:37:22 +00:00

adfs

fs/adfs: remove unneeded cast

2015-06-30 19:44:57 -07:00

affs

affs: fix remount failure when there are no options changed

2016-06-07 18:14:32 -07:00

afs

afs: Connect up the CB.ProbeUuid

2017-12-16 10:33:56 +01:00

autofs4

autofs: fix careless error in recent commit

2017-12-20 10:04:51 +01:00

befs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

bfs

…

btrfs

btrfs: clear space cache inode generation always

2017-12-05 11:22:50 +01:00

cachefiles

FS-Cache: Add missing initialization of ret in cachefiles_write_page()

2015-11-16 20:38:43 -05:00

ceph

ceph: drop negative child dentries before try pruning inode's alias

2017-12-20 10:04:52 +01:00

cifs

cifs: check MaxPathNameComponentLength != 0 before using it

2017-11-08 10:06:27 +01:00

coda

coda: fix 'kernel memory exposure attempt' in fsync

2017-11-24 08:32:25 +01:00

configfs

configfs: Fix race between create_link and configfs_rmdir

2017-06-26 07:13:08 +02:00

cramfs

…

debugfs

dentry name snapshots

2017-08-06 19:19:42 -07:00

devpts

devpts: clean up interface to pty drivers

2016-08-16 09:30:49 +02:00

dlm

dlm: avoid double-free on error path in dlm_device_{register,unregister}

2017-09-13 14:09:45 -07:00

ecryptfs

eCryptfs: use after free in ecryptfs_release_messaging()

2017-11-30 08:37:20 +00:00

efivarfs

efi: Make efivarfs entries immutable by default

2016-03-03 15:07:09 -08:00

efs

fs/efs: femove unneeded cast

2015-06-25 17:00:42 -07:00

exofs

osd fs: __r4w_get_page rely on PageUptodate for uptodate

2015-12-12 10:15:34 -08:00

exportfs

…

ext2

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

ext4

ext4: fix crash when a directory's i_size is too small

2017-12-20 10:04:52 +01:00

f2fs

fscrypto: require write access to mount to set encryption policy

2017-10-27 10:23:18 +02:00

fat

fat: fix using uninitialized fields of fat_inode/fsinfo_inode

2017-03-15 09:57:15 +08:00

freevxfs

freevxfs: Grammar s/an negative/a negative/

2015-08-07 13:59:24 +02:00

fscache

FS-Cache: fix dereference of NULL user_key_payload

2017-10-27 10:23:18 +02:00

fuse

fuse: fix READDIRPLUS skipping an entry

2017-11-02 09:40:49 +01:00

gfs2

GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next

2017-10-08 10:14:16 +02:00

hfs

hfs: fix B-tree corruption after insertion at position 0

2015-09-10 13:29:01 -07:00

hfsplus

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

hostfs

hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()

2016-09-30 10:18:39 +02:00

hpfs

hpfs: implement the show_options method

2016-06-01 12:15:54 -07:00

hugetlbfs

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

isofs

isofs: fix timestamps beyond 2027

2017-11-30 08:37:20 +00:00

jbd2

jbd2: don't leak modified metadata buffers on an aborted journal

2017-03-12 06:37:26 +01:00

jffs2

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

jfs

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

kernfs

kernfs: don't depend on d_find_any_alias() when generating notifications

2016-09-24 10:07:36 +02:00

lockd

Mainly smaller bugfixes and cleanup. We're still finding some bugs from

2015-11-11 20:11:28 -08:00

logfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

minix

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

ncpfs

ncpfs: fix a braino in OOM handling in ncp_fill_cache()

2016-03-16 08:42:59 -07:00

nfs

NFS: Fix a typo in nfs_rename()

2017-12-16 10:33:55 +01:00

nfs_common

lockd: NLM grace period shouldn't block NFSv4 opens

2015-08-13 10:22:06 -04:00

nfsd

nfsd: Fix another OPEN stateid race

2017-12-05 11:22:52 +01:00

nilfs2

nilfs2: fix race condition that causes file system corruption

2017-11-30 08:37:20 +00:00

nls

…

notify

dentry name snapshots

2017-08-06 19:19:42 -07:00

ntfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

ocfs2

Revert "ocfs2: should wait dio before inode lock in ocfs2_setattr()"

2017-12-09 18:42:43 +01:00

omfs

…

openpromfs

…

overlayfs

ovl: fsync after copy-up

2016-11-10 16:36:34 +01:00

proc

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

pstore

pstore: Use dynamic spinlock initializer

2017-08-06 19:19:43 -07:00

qnx4

…

qnx6

…

quota

quota: Fix possible GPF due to uninitialised pointers

2016-04-12 09:08:56 -07:00

ramfs

mm, fs: obey gfp_mapping for add_to_page_cache()

2015-10-16 11:42:28 -07:00

reiserfs

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

romfs

romfs: use different way to generate fsid for BLOCK or MTD

2017-06-17 06:39:38 +02:00

squashfs

squashfs: xattr simplifications

2015-11-13 20:34:33 -05:00

sysfs

sysfs: be careful of error returns from ops->show()

2017-04-12 12:38:33 +02:00

sysv

fix sysvfs symlinks

2015-11-23 21:11:08 -05:00

tracefs

tracefs: Fix refcount imbalance in start_creating()

2015-11-04 22:13:45 -05:00

ubifs

ubifs: Fix journal replay wrt. xattr nodes

2017-01-26 08:23:48 +01:00

udf

udf: Fix deadlock between writeback and udf_setsize()

2017-07-27 15:06:09 -07:00

ufs

ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path

2017-06-14 13:16:24 +02:00

xfs

xfs: remove kmem_zalloc_greedy

2017-10-08 10:14:20 +02:00

aio.c

aio: mark AIO pseudo-fs noexec

2016-10-07 15:23:47 +02:00

anon_inodes.c

…

attr.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

bad_inode.c

…

binfmt_aout.c

…

binfmt_elf_fdpic.c

libnvdimm for 4.4:

2015-11-10 12:07:22 -08:00

binfmt_elf.c

binfmt_elf: use ELF_ET_DYN_BASE only for PIE

2017-07-21 07:44:57 +02:00

binfmt_em86.c

…

binfmt_flat.c

…

binfmt_misc.c

…

binfmt_script.c

…

block_dev.c

fs/block_dev: always invalidate cleancache in invalidate_bdev()

2017-05-20 14:27:01 +02:00

buffer.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

char_dev.c

fs/char_dev.c: fix incorrect documentation for unregister_chrdev_region

2015-08-05 13:49:35 -07:00

compat_binfmt_elf.c

…

compat_ioctl.c

i2c-dev: Fix typo in ioctl name reference

2015-10-23 23:26:43 +02:00

compat.c

…

coredump.c

coredump: Ensure proper size of sparse core files

2017-07-05 14:37:20 +02:00

dax.c

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

dcache.c

dentry name snapshots

2017-08-06 19:19:42 -07:00

dcookies.c

…

direct-io.c

direct-io: Prevent NULL pointer access in submit_page_section

2017-10-18 09:20:42 +02:00

drop_caches.c

inode: convert inode_sb_list_lock to per-sb

2015-08-17 18:39:46 -04:00

eventfd.c

…

eventpoll.c

epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()

2017-09-07 08:34:10 +02:00

exec.c

exec: Limit arg stack to at most 75% of _STK_LIM

2017-07-21 07:44:57 +02:00

fcntl.c

fs: add a VALID_OPEN_FLAGS

2017-07-15 11:57:44 +02:00

fhandle.c

fs/coredump: prevent fsuid=0 dumps into user-controlled directories

2016-04-12 09:08:58 -07:00

file_table.c

fs, file table: reinit files_stat.max_files after deferred memory initialisation

2015-08-07 04:39:40 +03:00

file.c

vfs: clear remainder of 'full_fds_bits' in dup_fd()

2015-11-05 23:05:32 -08:00

filesystems.c

…

fs_pin.c

…

fs_struct.c

…

fs-writeback.c

writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode

2016-04-12 09:09:04 -07:00

inode.c

vfs: fix deadlock in file_remove_privs() on overlayfs

2016-08-10 11:49:30 +02:00

internal.h

inode: rename i_wb_list to i_io_list

2015-08-17 23:38:10 -04:00

ioctl.c

…

Kconfig

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

Kconfig.binfmt

…

libfs.c

fs: Set the size of empty dirs to 0.

2015-08-12 15:28:45 -05:00

locks.c

locks: use file_inode()

2016-08-10 11:49:27 +02:00

Makefile

ext4: promote ext4 over ext2 in the default probe order

2015-10-15 10:33:21 -04:00

mbcache.c

…

mount.h

mnt: In propgate_umount handle visiting mounts in any order

2017-07-21 07:44:57 +02:00

mpage.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

namei.c

dentry name snapshots

2017-08-06 19:19:42 -07:00

namespace.c

mnt: In propgate_umount handle visiting mounts in any order

2017-07-21 07:44:57 +02:00

no-block.c

…

nsfs.c

fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to void

2015-09-11 15:21:34 -07:00

open.c

fs: completely ignore unknown open flags

2017-07-15 11:57:44 +02:00

pipe.c

pipe: limit the per-user amount of pages allocated in pipes

2016-06-07 18:14:35 -07:00

pnode.c

mnt: Make propagate_umount less slow for overlapping mount propagation trees

2017-07-21 07:44:58 +02:00

pnode.h

mnt: Add a per mount namespace limit on the number of mounts

2017-04-30 05:49:28 +02:00

posix_acl.c

tmpfs: clear S_ISGID when setting posix ACLs

2017-01-26 08:23:47 +01:00

proc_namespace.c

vfs: show_vfsstat: do not ignore errors from show_devname method

2016-04-12 09:08:55 -07:00

read_write.c

vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets

2017-10-05 09:41:45 +02:00

readdir.c

…

select.c

…

seq_file.c

Make file credentials available to the seqfile interfaces

2017-08-06 19:19:42 -07:00

signalfd.c

signalfd: fix information leak in signalfd_copyinfo

2015-08-07 04:39:40 +03:00

splice.c

vfs: fix uninitialized flags in splice_to_pipe()

2017-02-23 17:43:09 +01:00

stack.c

…

stat.c

ufs: restore maintaining ->i_blocks

2017-06-14 13:16:24 +02:00

statfs.c

…

super.c

fs/super.c: fix race between freeze_super() and thaw_super()

2016-10-28 03:01:32 -04:00

sync.c

fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback

2015-11-06 17:50:42 -08:00

timerfd.c

timerfd: Protect the might cancel mechanism proper

2017-05-08 07:46:01 +02:00

userfaultfd.c

userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE

2017-12-20 10:04:53 +01:00

utimes.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

xattr.c

lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

2017-10-12 11:27:32 +02:00