1 files changed, 30 insertions, 31 deletions

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 2d115016feb4..c8c61b1eb479 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -384,40 +384,31 @@ static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *re
 #define VM_FAULT_BADACCESS      0x020000
 
 static vm_fault_t __do_page_fault(struct mm_struct *mm, unsigned long addr,
-                           unsigned int mm_flags, unsigned long vm_flags,
-                           struct task_struct *tsk)
+                           unsigned int mm_flags, unsigned long vm_flags)
 {
-        struct vm_area_struct *vma;
-        vm_fault_t fault;
+        struct vm_area_struct *vma = find_vma(mm, addr);
 
-        vma = find_vma(mm, addr);
-        fault = VM_FAULT_BADMAP;
         if (unlikely(!vma))
-                goto out;
-        if (unlikely(vma->vm_start > addr))
-                goto check_stack;
+                return VM_FAULT_BADMAP;
 
         /*
          * Ok, we have a good vm_area for this memory access, so we can handle
          * it.
          */
-good_area:
+        if (unlikely(vma->vm_start > addr)) {
+                if (!(vma->vm_flags & VM_GROWSDOWN))
+                        return VM_FAULT_BADMAP;
+                if (expand_stack(vma, addr))
+                        return VM_FAULT_BADMAP;
+        }
+
         /*
          * Check that the permissions on the VMA allow for the fault which
          * occurred.
          */
-        if (!(vma->vm_flags & vm_flags)) {
-                fault = VM_FAULT_BADACCESS;
-                goto out;
-        }
-
+        if (!(vma->vm_flags & vm_flags))
+                return VM_FAULT_BADACCESS;
         return handle_mm_fault(vma, addr & PAGE_MASK, mm_flags);
-
-check_stack:
-        if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
-                goto good_area;
-out:
-        return fault;
 }
 
 static bool is_el0_instruction_abort(unsigned int esr)
@@ -425,12 +416,20 @@ static bool is_el0_instruction_abort(unsigned int esr)
         return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_LOW;
 }
 
+/*
+ * Note: not valid for EL1 DC IVAC, but we never use that such that it
+ * should fault. EL0 cannot issue DC IVAC (undef).
+ */
+static bool is_write_abort(unsigned int esr)
+{
+        return (esr & ESR_ELx_WNR) && !(esr & ESR_ELx_CM);
+}
+
 static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
                                    struct pt_regs *regs)
 {
         const struct fault_info *inf;
-        struct task_struct *tsk;
-        struct mm_struct *mm;
+        struct mm_struct *mm = current->mm;
         vm_fault_t fault, major = 0;
         unsigned long vm_flags = VM_READ | VM_WRITE;
         unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
@@ -438,9 +437,6 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
         if (notify_page_fault(regs, esr))
                 return 0;
 
-        tsk = current;
-        mm  = tsk->mm;
-
         /*
          * If we're in an interrupt or have no user context, we must not take
          * the fault.
@@ -453,7 +449,8 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
 
         if (is_el0_instruction_abort(esr)) {
                 vm_flags = VM_EXEC;
-        } else if ((esr & ESR_ELx_WNR) && !(esr & ESR_ELx_CM)) {
+                mm_flags |= FAULT_FLAG_INSTRUCTION;
+        } else if (is_write_abort(esr)) {
                 vm_flags = VM_WRITE;
                 mm_flags |= FAULT_FLAG_WRITE;
         }
@@ -492,12 +489,14 @@ retry:
                  */
                 might_sleep();
 #ifdef CONFIG_DEBUG_VM
-                if (!user_mode(regs) && !search_exception_tables(regs->pc))
+                if (!user_mode(regs) && !search_exception_tables(regs->pc)) {
+                        up_read(&mm->mmap_sem);
                         goto no_context;
+                }
 #endif
         }
 
-        fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk);
+        fault = __do_page_fault(mm, addr, mm_flags, vm_flags);
         major |= fault & VM_FAULT_MAJOR;
 
         if (fault & VM_FAULT_RETRY) {
@@ -537,11 +536,11 @@ retry:
                  * that point.
                  */
                 if (major) {
-                        tsk->maj_flt++;
+                        current->maj_flt++;
                         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
                                       addr);
                 } else {
-                        tsk->min_flt++;
+                        current->min_flt++;
                         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs,
                                       addr);
                 }