On Thu, Jun 24, 2021 at 08:04:07AM +0100, Christoph Hellwig wrote:

On Thu, Jun 24, 2021 at 04:24:46AM +0100, Matthew Wilcox wrote:

quoted

On Thu, Jun 24, 2021 at 11:10:41AM +0800, Chen Huang wrote:

quoted

In userspace, I perform such operation:

 	fd = open("/tmp/test", O_RDWR | O_SYNC);
        access_address = (char *)mmap(NULL, uio_size, PROT_READ, MAP_SHARED, uio_fd, 0);
        ret = write(fd, access_address + 2, sizeof(long));

... you know that accessing this at unaligned offsets isn't going to
work.  It's completely meaningless.  Why are you trying to do it?

We still should not cause an infinite loop in kernel space due to a
a userspace programmer error.

They're running as root and they've mapped some device memory.  We can't
save them from themself.  Imagine if they'd done this to the NVMe BAR.