Re: [PATCH v3] /dev/mem: Bail out upon SIGKILL.

[Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>]

On 2019/08/26 22:29, Greg Kroah-Hartman wrote:
> On Mon, Aug 26, 2019 at 10:13:25PM +0900, Tetsuo Handa wrote:
>> syzbot found that a thread can stall for minutes inside read_mem() or
>> write_mem() after that thread was killed by SIGKILL [1]. Reading from
>> iomem areas of /dev/mem can be slow, depending on the hardware.
>> While reading 2GB at one read() is legal, delaying termination of killed
>> thread for minutes is bad. Thus, allow reading/writing /dev/mem and
>> /dev/kmem to be preemptible and killable.
>>
>>   [ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
>>   [ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
>>   [ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
>>   [ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
>>   [ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
>>
>> Theoretically, reading/writing /dev/mem and /dev/kmem can become
>> "interruptible". But this patch chose "killable". Future patch will make
>> them "interruptible" so that we can revert to "killable" if some program
>> regressed.
>>
>> [1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e
>>
>> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
>> Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40@syzkaller.appspotmail.com>
>> ---
>>  drivers/char/mem.c | 21 +++++++++++++++++++++
>>  1 file changed, 21 insertions(+)
> 
> What changed from previous versions?
> 
> That goes below the --- line at the very least.

(1) Moved fatal_signal_pending() test to end of iteration.
(2) Added need_resched() test before cond_resched().
(3) Removed -EINTR assignment because end of iteration means
    that at least one byte was processed (sz > 0).

> 
> thanks,
> 
> greg k-h
>