From: Jay Cornwall Date: Wed, 16 Sep 2015 19:10:03 +0000 (-0500) Subject: iommu/amd: Fix BUG when faulting a PROT_NONE VMA X-Git-Tag: v4.1.12-92~201^2~91 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=48c388e28ae1773d5fe26c98f02ec429c69ba7a8;p=users%2Fjedix%2Flinux-maple.git iommu/amd: Fix BUG when faulting a PROT_NONE VMA Orabug: 22623806 commit d14f6fced5f9360edca5a1325ddb7077aab1203b upstream. handle_mm_fault indirectly triggers a BUG in do_numa_page when given a VMA without read/write/execute access. Check this condition in do_fault. do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page mm/memory.c 3147 static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, .... 3159 /* A PROT_NONE fault should not end up here */ 3160 BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))); Signed-off-by: Jay Cornwall Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 75deee3f94d33c9858bbc2e7d67f43eaca84f5dc) Signed-off-by: Dan Duval --- diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c index 3465faf1809e4..45087c3e5c572 100644 --- a/drivers/iommu/amd_iommu_v2.c +++ b/drivers/iommu/amd_iommu_v2.c @@ -508,6 +508,13 @@ static void do_fault(struct work_struct *work) goto out; } + if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) { + /* handle_mm_fault would BUG_ON() */ + up_read(&mm->mmap_sem); + handle_fault_error(fault); + goto out; + } + ret = handle_mm_fault(mm, vma, address, write); if (ret & VM_FAULT_ERROR) { /* failed to service fault */