Re: possible deadlock in get_user_pages_unlocked

[Eric Biggers]

Hi Al,

On Sat, Feb 10, 2018 at 01:36:40AM +0000, Al Viro wrote:
> On Fri, Feb 02, 2018 at 09:57:27AM +0100, Dmitry Vyukov wrote:
> 
> > syzbot tests for up to 5 minutes. However, if there is a race involved
> > then you may need more time because the crash is probabilistic.
> > But from what I see most of the time, if one can't reproduce it
> > easily, it's usually due to some differences in setup that just don't
> > allow the crash to happen at all.
> > FWIW syzbot re-runs each reproducer on a freshly booted dedicated VM
> > and what it provided is the kernel output it got during run of the
> > provided program. So we have reasonably high assurance that this
> > reproducer worked in at least one setup.
> 
> Could you guys check if the following fixes the reproducer?
> 
> diff --git a/mm/gup.c b/mm/gup.c
> index 61015793f952..058a9a8e4e2e 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -861,6 +861,9 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk,
>  		BUG_ON(*locked != 1);
>  	}
>  
> +	if (flags & FOLL_NOWAIT)
> +		locked = NULL;
> +
>  	if (pages)
>  		flags |= FOLL_GET;
>  

Yes that fixes the reproducer for me.

- Eric