mm-commits Archive on
 help / color / Atom feed
* [merged] mm-close-race-between-munmap-and-expand_upwards-downwards.patch removed from -mm tree
@ 2020-07-24 23:38 akpm
  0 siblings, 0 replies; only message in thread
From: akpm @ 2020-07-24 23:38 UTC (permalink / raw)
  To: jannh, kirill.shutemov, mm-commits, oleg, stable, vbabka, willy,

The patch titled
     Subject: mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
has been removed from the -mm tree.  Its filename was

This patch was dropped because it was merged into mainline or a subsystem tree

From: "Kirill A. Shutemov" <>
Subject: mm/mmap.c: close race between munmap() and expand_upwards()/downwards()

VMA with VM_GROWSDOWN or VM_GROWSUP flag set can change their size under
mmap_read_lock().  It can lead to race with __do_munmap():

	Thread A			Thread B
				  vma->vm_start = address;
				  // The VMA now overlaps with
				  // VMAs detached by the Thread A
				// page fault populates expanded part
				// of the VMA
    // Zaps pagetables partly
    // populated by Thread B

Similar race exists for expand_upwards().

The fix is to avoid downgrading mmap_lock in __do_munmap() if detached

[ s/mmap_sem/mmap_lock/ in comment]
Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
Signed-off-by: Kirill A. Shutemov <>
Reported-by: Jann Horn <>
Acked-by: Vlastimil Babka <>
Reviewed-by: Yang Shi <>
Cc: Oleg Nesterov <>
Cc: Matthew Wilcox <>
Cc: <>	[4.20+]
Signed-off-by: Andrew Morton <>

 mm/mmap.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- a/mm/mmap.c~mm-close-race-between-munmap-and-expand_upwards-downwards
+++ a/mm/mmap.c
@@ -2620,7 +2620,7 @@ static void unmap_region(struct mm_struc
  * Create a list of vma's touched by the unmap, removing them from the mm's
  * vma list as we go..
-static void
+static bool
 detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
 	struct vm_area_struct *prev, unsigned long end)
@@ -2645,6 +2645,17 @@ detach_vmas_to_be_unmapped(struct mm_str
 	/* Kill the cache */
+	/*
+	 * Do not downgrade mmap_lock if we are next to VM_GROWSDOWN or
+	 * VM_GROWSUP VMA. Such VMAs can change their size under
+	 * down_read(mmap_lock) and collide with the VMA we are about to unmap.
+	 */
+	if (vma && (vma->vm_flags & VM_GROWSDOWN))
+		return false;
+	if (prev && (prev->vm_flags & VM_GROWSUP))
+		return false;
+	return true;
@@ -2825,7 +2836,8 @@ int __do_munmap(struct mm_struct *mm, un
 	/* Detach vmas from rbtree */
-	detach_vmas_to_be_unmapped(mm, vma, prev, end);
+	if (!detach_vmas_to_be_unmapped(mm, vma, prev, end))
+		downgrade = false;
 	if (downgrade)

Patches currently in -mm which might be from are

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-24 23:38 [merged] mm-close-race-between-munmap-and-expand_upwards-downwards.patch removed from -mm tree akpm

mm-commits Archive on

Archives are clonable:
	git clone --mirror mm-commits/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 mm-commits mm-commits/ \
	public-inbox-index mm-commits

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone