mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
f443fd5af5
Fix error handling in extract_iter_to_sg(). Pages need to be unpinned, not
put in extract_user_to_sg() when handling IOVEC/UBUF sources.
The bug may result in a warning like the following:
WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline]
WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]
WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline]
WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline]
WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 try_grab_page+0x108/0x160 mm/gup.c:252
...
pc : try_grab_page+0x108/0x160 mm/gup.c:229
lr : follow_page_pte+0x174/0x3e4 mm/gup.c:651
...
Call trace:
__lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline]
arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]
raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline]
atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline]
try_grab_page+0x108/0x160 mm/gup.c:252
follow_pmd_mask mm/gup.c:734 [inline]
follow_pud_mask mm/gup.c:765 [inline]
follow_p4d_mask mm/gup.c:782 [inline]
follow_page_mask+0x12c/0x2e4 mm/gup.c:839
__get_user_pages+0x174/0x30c mm/gup.c:1217
__get_user_pages_locked mm/gup.c:1448 [inline]
__gup_longterm_locked+0x94/0x8f4 mm/gup.c:2142
internal_get_user_pages_fast+0x970/0xb60 mm/gup.c:3140
pin_user_pages_fast+0x4c/0x60 mm/gup.c:3246
iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline]
iov_iter_extract_pages+0xc8/0x54c lib/iov_iter.c:1831
extract_user_to_sg lib/scatterlist.c:1123 [inline]
extract_iter_to_sg lib/scatterlist.c:1349 [inline]
extract_iter_to_sg+0x26c/0x6fc lib/scatterlist.c:1339
hash_sendmsg+0xc0/0x43c crypto/algif_hash.c:117
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x54/0x60 net/socket.c:748
____sys_sendmsg+0x270/0x2ac net/socket.c:2494
___sys_sendmsg+0x80/0xdc net/socket.c:2548
__sys_sendmsg+0x68/0xc4 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__arm64_sys_sendmsg+0x24/0x30 net/socket.c:2584
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52
el0_svc_common.constprop.0+0x44/0xe4 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x38/0xa4 arch/arm64/kernel/syscall.c:191
el0_svc+0x2c/0xb0 arch/arm64/kernel/entry-common.c:647
el0t_64_sync_handler+0xc0/0xc4 arch/arm64/kernel/entry-common.c:665
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:591
Link: https://lkml.kernel.org/r/20571.1690369076@warthog.procyon.org.uk
Fixes:
|
||
---|---|---|
.. | ||
842 | ||
crypto | ||
dim | ||
fonts | ||
kunit | ||
livepatch | ||
lz4 | ||
lzo | ||
math | ||
mpi | ||
pldmfw | ||
raid6 | ||
reed_solomon | ||
test_fortify | ||
vdso | ||
xz | ||
zlib_deflate | ||
zlib_dfltcc | ||
zlib_inflate | ||
zstd | ||
.gitignore | ||
argv_split.c | ||
ashldi3.c | ||
ashrdi3.c | ||
asn1_decoder.c | ||
asn1_encoder.c | ||
assoc_array.c | ||
atomic64.c | ||
atomic64_test.c | ||
audit.c | ||
base64.c | ||
bcd.c | ||
bch.c | ||
bitfield_kunit.c | ||
bitmap.c | ||
bitrev.c | ||
bootconfig-data.S | ||
bootconfig.c | ||
bsearch.c | ||
btree.c | ||
bucket_locks.c | ||
bug.c | ||
build_OID_registry | ||
buildid.c | ||
bust_spinlocks.c | ||
check_signature.c | ||
checksum.c | ||
checksum_kunit.c | ||
clz_ctz.c | ||
clz_tab.c | ||
cmdline.c | ||
cmdline_kunit.c | ||
cmpdi2.c | ||
compat_audit.c | ||
cpu_rmap.c | ||
cpumask.c | ||
cpumask_kunit.c | ||
crc-ccitt.c | ||
crc-itu-t.c | ||
crc-t10dif.c | ||
crc4.c | ||
crc7.c | ||
crc8.c | ||
crc16.c | ||
crc32.c | ||
crc32defs.h | ||
crc32test.c | ||
crc64-rocksoft.c | ||
crc64.c | ||
ctype.c | ||
debug_info.c | ||
debug_locks.c | ||
debugobjects.c | ||
dec_and_lock.c | ||
decompress.c | ||
decompress_bunzip2.c | ||
decompress_inflate.c | ||
decompress_unlz4.c | ||
decompress_unlzma.c | ||
decompress_unlzo.c | ||
decompress_unxz.c | ||
decompress_unzstd.c | ||
devmem_is_allowed.c | ||
devres.c | ||
dhry.h | ||
dhry_1.c | ||
dhry_2.c | ||
dhry_run.c | ||
digsig.c | ||
dump_stack.c | ||
dynamic_debug.c | ||
dynamic_queue_limits.c | ||
earlycpio.c | ||
errname.c | ||
error-inject.c | ||
errseq.c | ||
extable.c | ||
fault-inject-usercopy.c | ||
fault-inject.c | ||
fdt.c | ||
fdt_addresses.c | ||
fdt_empty_tree.c | ||
fdt_ro.c | ||
fdt_rw.c | ||
fdt_strerror.c | ||
fdt_sw.c | ||
fdt_wip.c | ||
find_bit.c | ||
find_bit_benchmark.c | ||
flex_proportions.c | ||
fortify_kunit.c | ||
gen_crc32table.c | ||
gen_crc64table.c | ||
genalloc.c | ||
generic-radix-tree.c | ||
glob.c | ||
globtest.c | ||
group_cpus.c | ||
hashtable_test.c | ||
hexdump.c | ||
hweight.c | ||
idr.c | ||
inflate.c | ||
interval_tree.c | ||
interval_tree_test.c | ||
iomap.c | ||
iomap_copy.c | ||
iommu-helper.c | ||
iov_iter.c | ||
irq_poll.c | ||
irq_regs.c | ||
is_signed_type_kunit.c | ||
is_single_threaded.c | ||
kasprintf.c | ||
Kconfig | ||
Kconfig.debug | ||
Kconfig.kasan | ||
Kconfig.kcsan | ||
Kconfig.kfence | ||
Kconfig.kgdb | ||
Kconfig.kmsan | ||
Kconfig.ubsan | ||
kfifo.c | ||
klist.c | ||
kobject.c | ||
kobject_uevent.c | ||
kstrtox.c | ||
kstrtox.h | ||
libcrc32c.c | ||
linear_ranges.c | ||
list-test.c | ||
list_debug.c | ||
list_sort.c | ||
llist.c | ||
locking-selftest-hardirq.h | ||
locking-selftest-mutex.h | ||
locking-selftest-rlock-hardirq.h | ||
locking-selftest-rlock-softirq.h | ||
locking-selftest-rlock.h | ||
locking-selftest-rsem.h | ||
locking-selftest-rtmutex.h | ||
locking-selftest-softirq.h | ||
locking-selftest-spin-hardirq.h | ||
locking-selftest-spin-softirq.h | ||
locking-selftest-spin.h | ||
locking-selftest-wlock-hardirq.h | ||
locking-selftest-wlock-softirq.h | ||
locking-selftest-wlock.h | ||
locking-selftest-wsem.h | ||
locking-selftest.c | ||
lockref.c | ||
logic_iomem.c | ||
logic_pio.c | ||
lru_cache.c | ||
lshrdi3.c | ||
Makefile | ||
maple_tree.c | ||
memcat_p.c | ||
memcpy_kunit.c | ||
memory-notifier-error-inject.c | ||
memregion.c | ||
memweight.c | ||
muldi3.c | ||
net_utils.c | ||
netdev-notifier-error-inject.c | ||
nlattr.c | ||
nmi_backtrace.c | ||
notifier-error-inject.c | ||
notifier-error-inject.h | ||
objagg.c | ||
of-reconfig-notifier-error-inject.c | ||
oid_registry.c | ||
once.c | ||
overflow_kunit.c | ||
packing.c | ||
parman.c | ||
parser.c | ||
pci_iomap.c | ||
percpu-refcount.c | ||
percpu_counter.c | ||
percpu_test.c | ||
plist.c | ||
pm-notifier-error-inject.c | ||
polynomial.c | ||
radix-tree.c | ||
radix-tree.h | ||
random32.c | ||
ratelimit.c | ||
rbtree.c | ||
rbtree_test.c | ||
rcuref.c | ||
ref_tracker.c | ||
refcount.c | ||
rhashtable.c | ||
sbitmap.c | ||
scatterlist.c | ||
seq_buf.c | ||
sg_pool.c | ||
sg_split.c | ||
siphash.c | ||
siphash_kunit.c | ||
slub_kunit.c | ||
smp_processor_id.c | ||
sort.c | ||
stackdepot.c | ||
stackinit_kunit.c | ||
stmp_device.c | ||
strcat_kunit.c | ||
string.c | ||
string_helpers.c | ||
strncpy_from_user.c | ||
strnlen_user.c | ||
strscpy_kunit.c | ||
syscall.c | ||
test-kstrtox.c | ||
test-string_helpers.c | ||
test_bitmap.c | ||
test_bitops.c | ||
test_bits.c | ||
test_blackhole_dev.c | ||
test_bpf.c | ||
test_debug_virtual.c | ||
test_dynamic_debug.c | ||
test_firmware.c | ||
test_fprobe.c | ||
test_fpu.c | ||
test_free_pages.c | ||
test_hash.c | ||
test_hexdump.c | ||
test_hmm.c | ||
test_hmm_uapi.h | ||
test_ida.c | ||
test_kmod.c | ||
test_kprobes.c | ||
test_linear_ranges.c | ||
test_list_sort.c | ||
test_lockup.c | ||
test_maple_tree.c | ||
test_memcat_p.c | ||
test_meminit.c | ||
test_min_heap.c | ||
test_module.c | ||
test_objagg.c | ||
test_parman.c | ||
test_printf.c | ||
test_ref_tracker.c | ||
test_rhashtable.c | ||
test_scanf.c | ||
test_sort.c | ||
test_static_key_base.c | ||
test_static_keys.c | ||
test_string.c | ||
test_sysctl.c | ||
test_ubsan.c | ||
test_user_copy.c | ||
test_uuid.c | ||
test_vmalloc.c | ||
test_xarray.c | ||
textsearch.c | ||
timerqueue.c | ||
trace_readwrite.c | ||
ts_bm.c | ||
ts_fsm.c | ||
ts_kmp.c | ||
ubsan.c | ||
ubsan.h | ||
ucmpdi2.c | ||
ucs2_string.c | ||
usercopy.c | ||
uuid.c | ||
vsprintf.c | ||
win_minmax.c | ||
xarray.c | ||
xxhash.c |