From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Oleg Nesterov <oleg@redhat.com>,
Kefeng Wang <wangkefeng.wang@huawei.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Peter Xu <peterx@redhat.com>, Mike Rapoport <rppt@linux.ibm.com>,
Jann Horn <jannh@google.com>, Jason Gunthorpe <jgg@mellanox.com>,
Michal Hocko <mhocko@suse.com>,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.14 43/62] userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
Date: Tue, 27 Aug 2019 09:50:48 +0200 [thread overview]
Message-ID: <20190827072703.069744154@linuxfoundation.org> (raw)
In-Reply-To: <20190827072659.803647352@linuxfoundation.org>
From: Oleg Nesterov <oleg@redhat.com>
commit 46d0b24c5ee10a15dfb25e20642f5a5ed59c5003 upstream.
userfaultfd_release() should clear vm_flags/vm_userfaultfd_ctx even if
mm->core_state != NULL.
Otherwise a page fault can see userfaultfd_missing() == T and use an
already freed userfaultfd_ctx.
Link: http://lkml.kernel.org/r/20190820160237.GB4983@redhat.com
Fixes: 04f5866e41fb ("coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping")
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Tested-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jason Gunthorpe <jgg@mellanox.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/userfaultfd.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -854,6 +854,7 @@ static int userfaultfd_release(struct in
/* len == 0 means wake all */
struct userfaultfd_wake_range range = { .len = 0, };
unsigned long new_flags;
+ bool still_valid;
ACCESS_ONCE(ctx->released) = true;
@@ -869,8 +870,7 @@ static int userfaultfd_release(struct in
* taking the mmap_sem for writing.
*/
down_write(&mm->mmap_sem);
- if (!mmget_still_valid(mm))
- goto skip_mm;
+ still_valid = mmget_still_valid(mm);
prev = NULL;
for (vma = mm->mmap; vma; vma = vma->vm_next) {
cond_resched();
@@ -881,19 +881,20 @@ static int userfaultfd_release(struct in
continue;
}
new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
- prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
- new_flags, vma->anon_vma,
- vma->vm_file, vma->vm_pgoff,
- vma_policy(vma),
- NULL_VM_UFFD_CTX);
- if (prev)
- vma = prev;
- else
- prev = vma;
+ if (still_valid) {
+ prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
+ new_flags, vma->anon_vma,
+ vma->vm_file, vma->vm_pgoff,
+ vma_policy(vma),
+ NULL_VM_UFFD_CTX);
+ if (prev)
+ vma = prev;
+ else
+ prev = vma;
+ }
vma->vm_flags = new_flags;
vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
}
-skip_mm:
up_write(&mm->mmap_sem);
mmput(mm);
wakeup:
next prev parent reply other threads:[~2019-08-27 7:53 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-27 7:50 [PATCH 4.14 00/62] 4.14.141-stable review Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 01/62] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 02/62] MIPS: kernel: only use i8253 clocksource with periodic clockevent Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 03/62] mips: fix cacheinfo Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 04/62] netfilter: ebtables: fix a memory leak bug in compat Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 05/62] ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 06/62] bonding: Force slave speed check after link state recovery for 802.3ad Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 07/62] can: dev: call netif_carrier_off() in register_candev() Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 08/62] ASoC: Fail card instantiation if DAI format setup fails Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 09/62] st21nfca_connectivity_event_received: null check the allocation Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 10/62] st_nci_hci_connectivity_event_received: " Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 11/62] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 12/62] net: usb: qmi_wwan: Add the BroadMobi BM818 card Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 13/62] qed: RDMA - Fix the hw_ver returned in device attributes Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 14/62] isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain() Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 15/62] netfilter: ipset: Fix rename concurrency with listing Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 16/62] isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 17/62] perf bench numa: Fix cpu0 binding Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 18/62] can: sja1000: force the string buffer NULL-terminated Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 19/62] can: peak_usb: " Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 20/62] net/ethernet/qlogic/qed: " Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 21/62] NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 22/62] HID: input: fix a4tech horizontal wheel custom usage Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 23/62] SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 24/62] net: cxgb3_main: Fix a resource leak in a error path in init_one() Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 25/62] net: hisilicon: make hip04_tx_reclaim non-reentrant Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 26/62] net: hisilicon: fix hip04-xmit never return TX_BUSY Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 27/62] net: hisilicon: Fix dma_map_single failed on arm64 Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 28/62] libata: have ata_scsi_rw_xlat() fail invalid passthrough requests Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 29/62] libata: add SG safety checks in SFF pio transfers Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 30/62] x86/lib/cpu: Address missing prototypes warning Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 31/62] drm/vmwgfx: fix memory leak when too many retries have occurred Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 32/62] perf ftrace: Fix failure to set cpumask when only one cpu is present Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 33/62] perf cpumap: Fix writing to illegal memory in handling cpumap mask Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 34/62] perf pmu-events: Fix missing "cpu_clk_unhalted.core" event Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 35/62] selftests: kvm: Adding config fragments Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 36/62] HID: wacom: correct misreported EKR ring values Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 37/62] HID: wacom: Correct distance scale for 2nd-gen Intuos devices Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 38/62] Revert "dm bufio: fix deadlock with loop device" Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 39/62] ceph: dont try fill file_lock on unsuccessful GETFILELOCK reply Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 40/62] libceph: fix PG split vs OSD (re)connect race Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 41/62] drm/nouveau: Dont retry infinitely when receiving no data on i2c over AUX Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 42/62] gpiolib: never report open-drain/source lines as input to user-space Greg Kroah-Hartman
2019-08-27 7:50 ` Greg Kroah-Hartman [this message]
2019-08-27 7:50 ` [PATCH 4.14 44/62] x86/retpoline: Dont clobber RFLAGS during CALL_NOSPEC on i386 Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 45/62] x86/apic: Handle missing global clockevent gracefully Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 46/62] x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 47/62] x86/boot: Save fields explicitly, zero out everything else Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 48/62] x86/boot: Fix boot regression caused by bootparam sanitizing Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 49/62] dm kcopyd: always complete failed jobs Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 50/62] dm btree: fix order of block initialization in btree_split_beneath Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 51/62] dm space map metadata: fix missing store of apply_bops() return value Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 52/62] dm table: fix invalid memory accesses with too high sector number Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 53/62] dm zoned: improve error handling in reclaim Greg Kroah-Hartman
2019-08-27 7:50 ` [PATCH 4.14 54/62] dm zoned: improve error handling in i/o map code Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 55/62] dm zoned: properly handle backing device failure Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 56/62] genirq: Properly pair kobject_del() with kobject_add() Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 57/62] mm, page_owner: handle THP splits correctly Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 58/62] mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 59/62] mm/zsmalloc.c: fix race condition in zs_destroy_pool Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 60/62] xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 61/62] dm zoned: fix potential NULL dereference in dmz_do_reclaim() Greg Kroah-Hartman
2019-08-27 7:51 ` [PATCH 4.14 62/62] powerpc: Allow flush_(inval_)dcache_range to work across ranges >4GB Greg Kroah-Hartman
2019-08-27 17:24 ` [PATCH 4.14 00/62] 4.14.141-stable review Guenter Roeck
2019-08-27 19:12 ` shuah
2019-08-28 4:17 ` kernelci.org bot
2019-08-28 4:53 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190827072703.069744154@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=jannh@google.com \
--cc=jgg@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mhocko@suse.com \
--cc=oleg@redhat.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=peterx@redhat.com \
--cc=rppt@linux.ibm.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=wangkefeng.wang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).