From: gchen.guomin@gmail.com To: "Michael S. Tsirkin" <mst@redhat.com> Cc: guominchen <guominchen@tencent.com>, <linux-mm@kvack.org>, <linux-kernel@vger.kernel.org>, Jason Wang <jasowang@redhat.com>, <netdev@vger.kernel.org> Subject: [PATCH] Fix mm->owner point to a task that does not exists Date: Sun, 9 Dec 2018 15:21:17 +0800 [thread overview] Message-ID: <1544340077-11491-1-git-send-email-gchen.guomin@gmail.com> (raw) From: guominchen <guominchen@tencent.com> Under normal circumstances,When do_exit exits, mm->owner will be updated, but when the kernel process calls unuse_mm and exits, mm->owner cannot be updated. And will point to a task that has been released. Below is my issue on vhost_net: A, B are two kernel processes(such as vhost_worker), C is a user space process(such as qemu), and all three use the mm of the user process C. Now, because user process C exits abnormally, the owner of this mm becomes A. When A calls unuse_mm and exits, this mm->ower still points to the A that has been released. When B accesses this mm->owner again, A has been released. Process A Process B vhost_worker() vhost_worker() --------- --------- use_mm() use_mm() ... unuse_mm() tsk->mm=NULL do_exit() page fault exit_mm() access mm->owner can't update owner kernel Oops unuse_mm() Cc: <linux-mm@kvack.org> Cc: <linux-kernel@vger.kernel.org> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: <netdev@vger.kernel.org> Signed-off-by: guominchen <guominchen@tencent.com> --- mm/mmu_context.c | 1 - 1 file changed, 1 deletion(-) diff --git a/mm/mmu_context.c b/mm/mmu_context.c index 3e612ae..185bb23 100644 --- a/mm/mmu_context.c +++ b/mm/mmu_context.c @@ -56,7 +56,6 @@ void unuse_mm(struct mm_struct *mm) task_lock(tsk); sync_mm_rss(mm); - tsk->mm = NULL; /* active_mm is still 'mm' */ enter_lazy_tlb(mm, tsk); task_unlock(tsk); -- 1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: gchen.guomin@gmail.com To: "Michael S. Tsirkin" <mst@redhat.com> Cc: guominchen <guominchen@tencent.com>, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Jason Wang <jasowang@redhat.com>, netdev@vger.kernel.org Subject: [PATCH] Fix mm->owner point to a task that does not exists Date: Sun, 9 Dec 2018 15:21:17 +0800 [thread overview] Message-ID: <1544340077-11491-1-git-send-email-gchen.guomin@gmail.com> (raw) From: guominchen <guominchen@tencent.com> Under normal circumstances,When do_exit exits, mm->owner will be updated, but when the kernel process calls unuse_mm and exits, mm->owner cannot be updated. And will point to a task that has been released. Below is my issue on vhost_net: A, B are two kernel processes(such as vhost_worker), C is a user space process(such as qemu), and all three use the mm of the user process C. Now, because user process C exits abnormally, the owner of this mm becomes A. When A calls unuse_mm and exits, this mm->ower still points to the A that has been released. When B accesses this mm->owner again, A has been released. Process A Process B vhost_worker() vhost_worker() --------- --------- use_mm() use_mm() ... unuse_mm() tsk->mm=NULL do_exit() page fault exit_mm() access mm->owner can't update owner kernel Oops unuse_mm() Cc: <linux-mm@kvack.org> Cc: <linux-kernel@vger.kernel.org> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: <netdev@vger.kernel.org> Signed-off-by: guominchen <guominchen@tencent.com> --- mm/mmu_context.c | 1 - 1 file changed, 1 deletion(-) diff --git a/mm/mmu_context.c b/mm/mmu_context.c index 3e612ae..185bb23 100644 --- a/mm/mmu_context.c +++ b/mm/mmu_context.c @@ -56,7 +56,6 @@ void unuse_mm(struct mm_struct *mm) task_lock(tsk); sync_mm_rss(mm); - tsk->mm = NULL; /* active_mm is still 'mm' */ enter_lazy_tlb(mm, tsk); task_unlock(tsk); -- 1.8.3.1
next reply other threads:[~2018-12-09 7:21 UTC|newest] Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-12-09 7:21 gchen.guomin [this message] 2018-12-09 7:21 ` [PATCH] Fix mm->owner point to a task that does not exists gchen.guomin 2018-12-10 1:36 ` Michael S. Tsirkin 2018-12-10 3:14 ` 答复: [PATCH] Fix mm->owner point to a task that does not exists(Internet mail) guominchen(陈国民) 2018-12-12 1:54 [PATCH] Fix mm->owner point to a task that does not exists gchen.guomin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1544340077-11491-1-git-send-email-gchen.guomin@gmail.com \ --to=gchen.guomin@gmail.com \ --cc=guominchen@tencent.com \ --cc=jasowang@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mst@redhat.com \ --cc=netdev@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.