Patch "userfaultfd: shmem: handle coredumping in handle_userfault()" has been added to the 4.11-stable tree

This is a note to let you know that I've just added the patch titled

userfaultfd: shmem: handle coredumping in handle_userfault()

to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
userfaultfd-shmem-handle-coredumping-in-handle_userfault.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andrea Arcangeli <[email protected]>
Date: Fri, 16 Jun 2017 14:02:37 -0700
Subject: userfaultfd: shmem: handle coredumping in handle_userfault()

From: Andrea Arcangeli <[email protected]>

commit 64c2b20301f62c697352c8028c569b1b2bdd8e82 upstream.

Anon and hugetlbfs handle FOLL_DUMP set by get_dump_page() internally to __get_user_pages().

shmem as opposed has no special FOLL_DUMP handling there so handle_mm_fault() is invoked without mmap_sem and ends up calling handle_userfault() that isn't expecting to be invoked without mmap_sem held.

This makes handle_userfault() fail immediately if invoked through shmem_vm_ops->fault during coredumping and solves the problem.

The side effect is a BUG_ON with no lock held triggered by the coredumping process which exits. Only 4.11 is affected, pre-4.11 anon memory holes are skipped in __get_user_pages by checking FOLL_DUMP explicitly against empty pagetables (mm/gup.c:no_page_table()).

It's zero cost as we already had a check for current->flags to prevent futex to trigger userfaults during exit (PF_EXITING).

---
 fs/userfaultfd.c |   29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

@@ -340,9 +340,28 @@ int handle_userfault(struct vm_fault *vm
 	bool must_wait, return_to_userland;
 	long blocking_state;
 
-	BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
-
 	ret = VM_FAULT_SIGBUS;
+
+	/*
+	 * We don't do userfault handling for the final child pid update.
+	 *
+	 * We also don't do userfault handling during
+	 * coredumping. hugetlbfs has the special
+	 * follow_hugetlb_page() to skip missing pages in the
+	 * FOLL_DUMP case, anon memory also checks for FOLL_DUMP with
+	 * the no_page_table() helper in follow_page_mask(), but the
+	 * shmem_vm_ops->fault method is invoked even during
+	 * coredumping without mmap_sem and it ends up here.
+	 */
+	if (current->flags & (PF_EXITING|PF_DUMPCORE))
+		goto out;
+
+	/*
+	 * Coredumping runs without mmap_sem so we can only check that
+	 * the mmap_sem is held, if PF_DUMPCORE was not set.
+	 */
+	WARN_ON_ONCE(!rwsem_is_locked(&mm->mmap_sem));
+
 	ctx = vmf->vma->vm_userfaultfd_ctx.ctx;
 	if (!ctx)
 		goto out;

@@ -361,12 +380,6 @@ int handle_userfault(struct vm_fault *vm
 		goto out;
 
 	/*
-	 * We don't do userfault handling for the final child pid update.
-	 */
-	if (current->flags & PF_EXITING)
-		goto out;
-
-	/*
 	 * Check that we can return VM_FAULT_RETRY.
 	 *
 	 * NOTE: it should become possible to return VM_FAULT_RETRY

Patches currently in stable-queue which might be from [email protected] are

queue-4.11/userfaultfd-shmem-handle-coredumping-in-handle_userfault.patch queue-4.11/drm-i915-do-not-sync-rcu-during-shrinking.patch