From: Chen Huang <chenhuang5@huawei.com>
To: Andrew Morton <akpm@linux-foundation.org>,
Stephen Rothwell <sfr@canb.auug.org.au>,
"Matthew Wilcox (Oracle)" <willy@infradead.org>,
"Al Viro" <viro@zeniv.linux.org.uk>,
Randy Dunlap <rdunlap@infradead.org>,
"Catalin Marinas" <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>
Cc: Linux ARM <linux-arm-kernel@lists.infradead.org>,
linux-mm <linux-mm@kvack.org>,
open list <linux-kernel@vger.kernel.org>
Subject: [BUG] arm64: an infinite loop in generic_perform_write()
Date: Wed, 23 Jun 2021 10:39:31 +0800 [thread overview]
Message-ID: <da9c2fa9-a545-0c48-4490-d6134cc31425@huawei.com> (raw)
When we access a device memory in userspace, then perform an unaligned write to a file.
For example, we register a uio device and mmap the device, then perform an write to a
file, like that:
device_addr = mmap(device_fd);
write(file_fd, device_addr + unaligned_num, size);
We found that the infinite loop happened in generic_perform_write function:
again:
copied = copy_page_from_iter_atomic(); //copied = 0
status = ops->write_end(); //status = 0
if (status == 0)
goto again;
In copy_page_from_iter_atomic, the copyin() function finally call
__arch_copy_from_user which create an exception table entry for 'insn'.
Then when kernel handles the alignment_fault, it will not panic. As the
arm64 memory model spec said, when the address is not a multiple of the
element size, the access is unaligned. Unaligned accesses are allowed to
addresses marked as Normal, but not to Device regions. An unaligned access
to a Device region will trigger an exception (alignment fault).
do_alignment_fault
do_bad_area
__do_kernel_fault
fixup_exception
But that fixup cann't handle the unaligned copy, so the
copy_page_from_iter_atomic returns 0 and traps in loop.
Reported-by: Chen Huang <chenhuang5@huawei.com>
next reply other threads:[~2021-06-23 2:39 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-23 2:39 Chen Huang [this message]
2021-06-23 2:50 ` Al Viro
2021-06-23 3:24 ` Xiaoming Ni
2021-06-23 4:27 ` Al Viro
2021-06-23 9:32 ` Catalin Marinas
2021-06-23 11:51 ` Matthew Wilcox
2021-06-23 13:04 ` Al Viro
2021-06-23 13:22 ` Mark Rutland
2021-06-24 3:10 ` Chen Huang
2021-06-24 3:24 ` Matthew Wilcox
2021-06-24 3:52 ` Chen Huang
2021-06-24 7:04 ` Christoph Hellwig
2021-06-24 11:15 ` Matthew Wilcox
2021-06-24 13:22 ` Robin Murphy
2021-06-24 16:27 ` Al Viro
2021-06-24 16:38 ` Robin Murphy
2021-06-24 16:39 ` Al Viro
2021-06-24 17:24 ` Robin Murphy
2021-06-24 18:55 ` Catalin Marinas
2021-06-24 20:36 ` Robin Murphy
2021-06-25 10:39 ` Catalin Marinas
2021-06-28 16:22 ` Robin Murphy
2021-06-29 8:30 ` Catalin Marinas
2021-06-29 10:01 ` Robin Murphy
2021-07-06 17:50 ` Catalin Marinas
2021-07-06 19:15 ` Robin Murphy
2021-07-07 9:55 ` David Laight
2021-07-07 11:04 ` Robin Murphy
2021-07-07 12:50 ` Catalin Marinas
2021-06-24 15:09 ` Catalin Marinas
2021-06-24 16:17 ` Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=da9c2fa9-a545-0c48-4490-d6134cc31425@huawei.com \
--to=chenhuang5@huawei.com \
--cc=akpm@linux-foundation.org \
--cc=catalin.marinas@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=rdunlap@infradead.org \
--cc=sfr@canb.auug.org.au \
--cc=viro@zeniv.linux.org.uk \
--cc=will@kernel.org \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®