From: Chris Mason <[email protected]>
Reading /proc/<pid>/cmdline or /proc/<pid>/environ can block in a device
driver, or read device memory, if the virtual addresses point at a device
mapping.
Ever since commit 7f7ccc2ccc2e ("proc: do not access cmdline nor environ
from file-backed areas") we use FOLL_ANON to only read from anonymous
memory. While GUP properly handles FOLL_ANON, __access_remote_vm()
will fall back on GUP errors to vma->vm_ops->access() without similarly
considering the flag.
Fix it by not calling vm_ops->access if FOLL_ANON was specified, to
truly limit it to anonymous memory only.
Fixes: 7f7ccc2ccc2e ("proc: do not access cmdline nor environ from file-backed
areas")
Signed-off-by: Chris Mason <[email protected]>
Cc: [email protected]
[ david: simplify description; slightly rework implementation ]
Signed-off-by: David Hildenbrand (Arm) <[email protected]>
---
mm/memory.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/memory.c b/mm/memory.c
index 1a0ec09c56fd7..d4370c1b331c9 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -7398,6 +7398,9 @@ static int __access_remote_vm(struct mm_struct *mm,
unsigned long addr,
continue;
}
+ if (gup_flags & FOLL_ANON)
+ break;
+
/*
* Check if this is a VM_IO | VM_PFNMAP VMA, which
* we can access using slightly different code.
--
2.43.0
