Stable Archive on lore.kernel.org
 help / color / Atom feed
* Re: [PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
  2019-05-22 19:37 [PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping Ajay Kaher
@ 2019-05-22 12:07 ` Jason Gunthorpe
  2019-06-06 10:25   ` Ajay Kaher
  0 siblings, 1 reply; 5+ messages in thread
From: Jason Gunthorpe @ 2019-05-22 12:07 UTC (permalink / raw)
  To: Ajay Kaher
  Cc: aarcange, jannh, oleg, peterx, rppt, mhocko, stable, srivatsa,
	amakhalov, Andrew Morton, Linus Torvalds, Greg Kroah-Hartman

On Thu, May 23, 2019 at 01:07:30AM +0530, Ajay Kaher wrote:
> From: Andrea Arcangeli <aarcange@redhat.com>
> 
> commit 1eb719f09f7e319e79f6abf2b9e8c0dcc1c477b5 upstream.

This is not the right commit id..

> The core dumping code has always run without holding the mmap_sem for
> writing, despite that is the only way to ensure that the entire vma
> layout will not change from under it.  Only using some signal
> serialization on the processes belonging to the mm is not nearly enough.
> This was pointed out earlier.  For example in Hugh's post from Jul 2017:
> 
>   https://lkml.kernel.org/r/alpine.LSU.2.11.1707191716030.2055@eggly.anvils
> 
>   "Not strictly relevant here, but a related note: I was very surprised
>    to discover, only quite recently, how handle_mm_fault() may be called
>    without down_read(mmap_sem) - when core dumping. That seems a
>    misguided optimization to me, which would also be nice to correct"
> 
> In particular because the growsdown and growsup can move the
> vm_start/vm_end the various loops the core dump does around the vma will
> not be consistent if page faults can happen concurrently.
> 
> Pretty much all users calling mmget_not_zero()/get_task_mm() and then
> taking the mmap_sem had the potential to introduce unexpected side
> effects in the core dumping code.
> 
> Adding mmap_sem for writing around the ->core_dump invocation is a
> viable long term fix, but it requires removing all copy user and page
> faults and to replace them with get_dump_page() for all binary formats
> which is not suitable as a short term fix.
> 
> For the time being this solution manually covers the places that can
> confuse the core dump either by altering the vma layout or the vma flags
> while it runs.  Once ->core_dump runs under mmap_sem for writing the
> function mmget_still_valid() can be dropped.
> 
> Allowing mmap_sem protected sections to run in parallel with the
> coredump provides some minor parallelism advantage to the swapoff code
> (which seems to be safe enough by never mangling any vma field and can
> keep doing swapins in parallel to the core dumping) and to some other
> corner case.
> 
> In order to facilitate the backporting I added "Fixes: 86039bd3b4e6"
> however the side effect of this same race condition in /proc/pid/mem
> should be reproducible since before 2.6.12-rc2 so I couldn't add any
> other "Fixes:" because there's no hash beyond the git genesis commit.
> 
> Because find_extend_vma() is the only location outside of the process
> context that could modify the "mm" structures under mmap_sem for
> reading, by adding the mmget_still_valid() check to it, all other cases
> that take the mmap_sem for reading don't need the new check after
> mmget_not_zero()/get_task_mm().  The expand_stack() in page fault
> context also doesn't need the new check, because all tasks under core
> dumping are frozen.
> 
> Link: http://lkml.kernel.org/r/20190325224949.11068-1-aarcange@redhat.com
> Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization")
> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
> Reported-by: Jann Horn <jannh@google.com>
> Suggested-by: Oleg Nesterov <oleg@redhat.com>
> Acked-by: Peter Xu <peterx@redhat.com>
> Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
> Reviewed-by: Oleg Nesterov <oleg@redhat.com>
> Reviewed-by: Jann Horn <jannh@google.com>
> Acked-by: Jason Gunthorpe <jgg@mellanox.com>
> Acked-by: Michal Hocko <mhocko@suse.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> [Ajay: Dropped infiniband changes to get patch to apply on 4.9.y]

I think in this kernel the mm handling code for IB is in three
different drivers, it probably needs to be fixed too?

Jason

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
@ 2019-05-22 19:37 Ajay Kaher
  2019-05-22 12:07 ` Jason Gunthorpe
  0 siblings, 1 reply; 5+ messages in thread
From: Ajay Kaher @ 2019-05-22 19:37 UTC (permalink / raw)
  To: aarcange, jannh, oleg, peterx, rppt, jgg, mhocko
  Cc: stable, akaher, srivatsa, amakhalov, Andrew Morton,
	Linus Torvalds, Greg Kroah-Hartman

From: Andrea Arcangeli <aarcange@redhat.com>

commit 1eb719f09f7e319e79f6abf2b9e8c0dcc1c477b5 upstream.

The core dumping code has always run without holding the mmap_sem for
writing, despite that is the only way to ensure that the entire vma
layout will not change from under it.  Only using some signal
serialization on the processes belonging to the mm is not nearly enough.
This was pointed out earlier.  For example in Hugh's post from Jul 2017:

  https://lkml.kernel.org/r/alpine.LSU.2.11.1707191716030.2055@eggly.anvils

  "Not strictly relevant here, but a related note: I was very surprised
   to discover, only quite recently, how handle_mm_fault() may be called
   without down_read(mmap_sem) - when core dumping. That seems a
   misguided optimization to me, which would also be nice to correct"

In particular because the growsdown and growsup can move the
vm_start/vm_end the various loops the core dump does around the vma will
not be consistent if page faults can happen concurrently.

Pretty much all users calling mmget_not_zero()/get_task_mm() and then
taking the mmap_sem had the potential to introduce unexpected side
effects in the core dumping code.

Adding mmap_sem for writing around the ->core_dump invocation is a
viable long term fix, but it requires removing all copy user and page
faults and to replace them with get_dump_page() for all binary formats
which is not suitable as a short term fix.

For the time being this solution manually covers the places that can
confuse the core dump either by altering the vma layout or the vma flags
while it runs.  Once ->core_dump runs under mmap_sem for writing the
function mmget_still_valid() can be dropped.

Allowing mmap_sem protected sections to run in parallel with the
coredump provides some minor parallelism advantage to the swapoff code
(which seems to be safe enough by never mangling any vma field and can
keep doing swapins in parallel to the core dumping) and to some other
corner case.

In order to facilitate the backporting I added "Fixes: 86039bd3b4e6"
however the side effect of this same race condition in /proc/pid/mem
should be reproducible since before 2.6.12-rc2 so I couldn't add any
other "Fixes:" because there's no hash beyond the git genesis commit.

Because find_extend_vma() is the only location outside of the process
context that could modify the "mm" structures under mmap_sem for
reading, by adding the mmget_still_valid() check to it, all other cases
that take the mmap_sem for reading don't need the new check after
mmget_not_zero()/get_task_mm().  The expand_stack() in page fault
context also doesn't need the new check, because all tasks under core
dumping are frozen.

Link: http://lkml.kernel.org/r/20190325224949.11068-1-aarcange@redhat.com
Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization")
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Jann Horn <jannh@google.com>
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Jann Horn <jannh@google.com>
Acked-by: Jason Gunthorpe <jgg@mellanox.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Ajay: Dropped infiniband changes to get patch to apply on 4.9.y]
Signed-off-by: Ajay Kaher <akaher@vmware.com>
Reviewed-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu>
---
 fs/proc/task_mmu.c    | 18 ++++++++++++++++++
 fs/userfaultfd.c      |  9 +++++++++
 include/linux/sched.h | 21 +++++++++++++++++++++
 mm/mmap.c             |  7 ++++++-
 4 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 5138e78..4b207b1 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1057,6 +1057,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
 					count = -EINTR;
 					goto out_mm;
 				}
+				/*
+				 * Avoid to modify vma->vm_flags
+				 * without locked ops while the
+				 * coredump reads the vm_flags.
+				 */
+				if (!mmget_still_valid(mm)) {
+					/*
+					 * Silently return "count"
+					 * like if get_task_mm()
+					 * failed. FIXME: should this
+					 * function have returned
+					 * -ESRCH if get_task_mm()
+					 * failed like if
+					 * get_proc_task() fails?
+					 */
+					up_write(&mm->mmap_sem);
+					goto out_mm;
+				}
 				for (vma = mm->mmap; vma; vma = vma->vm_next) {
 					vma->vm_flags &= ~VM_SOFTDIRTY;
 					vma_set_page_prot(vma);
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 784d667..8bf425a 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -479,6 +479,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
 	 * taking the mmap_sem for writing.
 	 */
 	down_write(&mm->mmap_sem);
+	if (!mmget_still_valid(mm))
+		goto skip_mm;
 	prev = NULL;
 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
 		cond_resched();
@@ -501,6 +503,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
 		vma->vm_flags = new_flags;
 		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
 	}
+skip_mm:
 	up_write(&mm->mmap_sem);
 	mmput(mm);
 wakeup:
@@ -802,6 +805,9 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
 		goto out;
 
 	down_write(&mm->mmap_sem);
+	if (!mmget_still_valid(mm))
+		goto out_unlock;
+
 	vma = find_vma_prev(mm, start, &prev);
 	if (!vma)
 		goto out_unlock;
@@ -947,6 +953,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
 		goto out;
 
 	down_write(&mm->mmap_sem);
+	if (!mmget_still_valid(mm))
+		goto out_unlock;
+
 	vma = find_vma_prev(mm, start, &prev);
 	if (!vma)
 		goto out_unlock;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 1c487a3..c3d9ca0 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -2933,6 +2933,27 @@ static inline void mmdrop_async(struct mm_struct *mm)
 	}
 }
 
+/*
+ * This has to be called after a get_task_mm()/mmget_not_zero()
+ * followed by taking the mmap_sem for writing before modifying the
+ * vmas or anything the coredump pretends not to change from under it.
+ *
+ * NOTE: find_extend_vma() called from GUP context is the only place
+ * that can modify the "mm" (notably the vm_start/end) under mmap_sem
+ * for reading and outside the context of the process, so it is also
+ * the only case that holds the mmap_sem for reading that must call
+ * this function. Generally if the mmap_sem is hold for reading
+ * there's no need of this check after get_task_mm()/mmget_not_zero().
+ *
+ * This function can be obsoleted and the check can be removed, after
+ * the coredump code will hold the mmap_sem for writing before
+ * invoking the ->core_dump methods.
+ */
+static inline bool mmget_still_valid(struct mm_struct *mm)
+{
+        return likely(!mm->core_state);
+}
+
 static inline bool mmget_not_zero(struct mm_struct *mm)
 {
 	return atomic_inc_not_zero(&mm->mm_users);
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f2314a..acd93d1 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -45,6 +45,7 @@
 #include <linux/moduleparam.h>
 #include <linux/pkeys.h>
 
+#include <linux/sched.h>
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
 #include <asm/tlb.h>
@@ -2448,7 +2449,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
 	vma = find_vma_prev(mm, addr, &prev);
 	if (vma && (vma->vm_start <= addr))
 		return vma;
-	if (!prev || expand_stack(prev, addr))
+	/* don't alter vm_end if the coredump is running */
+	if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr))
 		return NULL;
 	if (prev->vm_flags & VM_LOCKED)
 		populate_vma_page_range(prev, addr, prev->vm_end, NULL);
@@ -2474,6 +2476,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
 		return vma;
 	if (!(vma->vm_flags & VM_GROWSDOWN))
 		return NULL;
+	/* don't alter vm_start if the coredump is running */
+	if (!mmget_still_valid(mm))
+		return NULL;
 	start = vma->vm_start;
 	if (expand_stack(vma, addr))
 		return NULL;
-- 
2.7.4


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
  2019-05-22 12:07 ` Jason Gunthorpe
@ 2019-06-06 10:25   ` Ajay Kaher
  2019-06-06 13:01     ` Jason Gunthorpe
  0 siblings, 1 reply; 5+ messages in thread
From: Ajay Kaher @ 2019-06-06 10:25 UTC (permalink / raw)
  To: Jason Gunthorpe
  Cc: aarcange, jannh, oleg, peterx, rppt, mhocko, stable, srivatsa,
	Alexey Makhalov, Andrew Morton, Linus Torvalds,
	Greg Kroah-Hartman



On 22/05/19, 5:37 PM, "Jason Gunthorpe" <jgg@mellanox.com> wrote:

>On Thu, May 23, 2019 at 01:07:30AM +0530, Ajay Kaher wrote:
>> From: Andrea Arcangeli <aarcange@redhat.com>
>> 
>> commit 1eb719f09f7e319e79f6abf2b9e8c0dcc1c477b5 upstream.
>
> This is not the right commit id..
In next version of this patch I will add the correct commit i.e. 04f5866e41fb70690e28397487d8bd8eea7d712a 
>
>> The core dumping code has always run without holding the mmap_sem for
>> writing, despite that is the only way to ensure that the entire vma
>> layout will not change from under it.  Only using some signal
>> serialization on the processes belonging to the mm is not nearly enough.
>> This was pointed out earlier.  For example in Hugh's post from Jul 2017:
>> 
>>   https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flkml.kernel.org%2Fr%2Falpine.LSU.2.11.1707191716030.2055%40eggly.anvils&amp;data=02%7C01%7Cakaher%40vmware.com%7Cb42dd5dedf954b7def5908d6deae17d9%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C636941236650210488&amp;sdata=c47vXAvgRV1GKWdBffBxj0I8UgJ7voQXIA7UPEUNq54%3D&amp;reserved=0
>> 
>>   "Not strictly relevant here, but a related note: I was very surprised
>>     to discover, only quite recently, how handle_mm_fault() may be called
>>     without down_read(mmap_sem) - when core dumping. That seems a
>>     misguided optimization to me, which would also be nice to correct"
>> 
>> In particular because the growsdown and growsup can move the
>> vm_start/vm_end the various loops the core dump does around the vma will
>> not be consistent if page faults can happen concurrently.
>> 
>> Pretty much all users calling mmget_not_zero()/get_task_mm() and then
>> taking the mmap_sem had the potential to introduce unexpected side
>> effects in the core dumping code.
>> 
>> Adding mmap_sem for writing around the ->core_dump invocation is a
>> viable long term fix, but it requires removing all copy user and page
>> faults and to replace them with get_dump_page() for all binary formats
>> which is not suitable as a short term fix.
>> 
>> For the time being this solution manually covers the places that can
>> confuse the core dump either by altering the vma layout or the vma flags
>> while it runs.  Once ->core_dump runs under mmap_sem for writing the
>> function mmget_still_valid() can be dropped.
>> 
>> Allowing mmap_sem protected sections to run in parallel with the
>> coredump provides some minor parallelism advantage to the swapoff code
>> (which seems to be safe enough by never mangling any vma field and can
>> keep doing swapins in parallel to the core dumping) and to some other
>> corner case.
>> 
>> In order to facilitate the backporting I added "Fixes: 86039bd3b4e6"
>> however the side effect of this same race condition in /proc/pid/mem
>> should be reproducible since before 2.6.12-rc2 so I couldn't add any
>> other "Fixes:" because there's no hash beyond the git genesis commit.
>> 
>> Because find_extend_vma() is the only location outside of the process
>> context that could modify the "mm" structures under mmap_sem for
>> reading, by adding the mmget_still_valid() check to it, all other cases
>> that take the mmap_sem for reading don't need the new check after
>> mmget_not_zero()/get_task_mm().  The expand_stack() in page fault
>> context also doesn't need the new check, because all tasks under core
>> dumping are frozen.
>> 
>> Link: https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flkml.kernel.org%2Fr%2F20190325224949.11068-1-aarcange%40redhat.com&amp;data=02%7C01%7Cakaher%40vmware.com%7Cb42dd5dedf954b7def5908d6deae17d9%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C636941236650220488&amp;sdata=nJ7a8%2FLkSU4eT%2FioUqf8tj2ewzJKcyrg2R0ZjGWEZzA%3D&amp;reserved=0
>> Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization")
>> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
>> Reported-by: Jann Horn <jannh@google.com>
>> Suggested-by: Oleg Nesterov <oleg@redhat.com>
>> Acked-by: Peter Xu <peterx@redhat.com>
>> Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
>> Reviewed-by: Oleg Nesterov <oleg@redhat.com>
>> Reviewed-by: Jann Horn <jannh@google.com>
>> Acked-by: Jason Gunthorpe <jgg@mellanox.com>
>> Acked-by: Michal Hocko <mhocko@suse.com>
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> [Ajay: Dropped infiniband changes to get patch to apply on 4.9.y]
>
> I think in this kernel the mm handling code for IB is in three
> different drivers, it probably needs to be fixed too?

Thanks Jason for pointing this.
  
Crossed checked the locking of mmap_sem in IB driver code of 4.9 to 4.14 with >5.0
and found it requires to handle at following locations of 4.9 and 4.14:
mlx4_ib_disassociate_ucontext() of drivers/infiniband/hw/mlx5/main.c:
mlx5_ib_disassociate_ucontext() of drivers/infiniband/hw/mlx4/main.c

To fix at above location, would you like me to modify the original patch or submit in another patch.

Ajay

> Jason



^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
  2019-06-06 10:25   ` Ajay Kaher
@ 2019-06-06 13:01     ` Jason Gunthorpe
  2019-06-06 13:50       ` Ajay Kaher
  0 siblings, 1 reply; 5+ messages in thread
From: Jason Gunthorpe @ 2019-06-06 13:01 UTC (permalink / raw)
  To: Ajay Kaher
  Cc: aarcange, jannh, oleg, peterx, rppt, mhocko, stable, srivatsa,
	Alexey Makhalov, Andrew Morton, Linus Torvalds,
	Greg Kroah-Hartman

On Thu, Jun 06, 2019 at 10:25:23AM +0000, Ajay Kaher wrote:

> > I think in this kernel the mm handling code for IB is in three
> > different drivers, it probably needs to be fixed too?
> 
> Thanks Jason for pointing this.
>   
> Crossed checked the locking of mmap_sem in IB driver code of 4.9 to 4.14 with >5.0
> and found it requires to handle at following locations of 4.9 and 4.14:
> mlx4_ib_disassociate_ucontext() of drivers/infiniband/hw/mlx5/main.c:
> mlx5_ib_disassociate_ucontext() of drivers/infiniband/hw/mlx4/main.c
> 
> To fix at above location, would you like me to modify the original
> patch or submit in another patch.

I think it is a backporting thing, so you should put the new work in
this patch? I'm not sure.

I'm also surprised hns isn't in the above list of drivers, but maybe
hns didn't have this support in these kernels..

Jason

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
  2019-06-06 13:01     ` Jason Gunthorpe
@ 2019-06-06 13:50       ` Ajay Kaher
  0 siblings, 0 replies; 5+ messages in thread
From: Ajay Kaher @ 2019-06-06 13:50 UTC (permalink / raw)
  To: Jason Gunthorpe
  Cc: aarcange, jannh, oleg, peterx, rppt, mhocko, stable, srivatsa,
	Alexey Makhalov, Andrew Morton, Linus Torvalds,
	Greg Kroah-Hartman



On 06/06/19, 6:31 PM, "Jason Gunthorpe" <jgg@mellanox.com> wrote:

>On Thu, Jun 06, 2019 at 10:25:23AM +0000, Ajay Kaher wrote:
>
>> > I think in this kernel the mm handling code for IB is in three
>> > different drivers, it probably needs to be fixed too?
>> 
>> Thanks Jason for pointing this.
>>   
>> Crossed checked the locking of mmap_sem in IB driver code of 4.9 to 4.14 with >5.0
>> and found it requires to handle at following locations of 4.9 and 4.14:
>> mlx4_ib_disassociate_ucontext() of drivers/infiniband/hw/mlx5/main.c:
>> mlx5_ib_disassociate_ucontext() of drivers/infiniband/hw/mlx4/main.c
>> 
>> To fix at above location, would you like me to modify the original
>> patch or submit in another patch.
>
> I think it is a backporting thing, so you should put the new work in
> this patch? I'm not sure.

Ok, I would like to submit new patch for new work in 4.14, and then
backport to 4.9, soon I will submit for review.

Re-submitted the this patch again after correcting the upstream commit, as:
Sub: [PATCH v2 1/1] [v4.9.y] coredump: fix race condition between 
         mmget_not_zero()/get_task_mm() and core dumping

Please review.

> I'm also surprised hns isn't in the above list of drivers, but maybe
> hns didn't have this support in these kernels..

IB->hns doesn't have any instance of mmap_sem checked for 4.9-4.14.

>Jason
>


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, back to index

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-22 19:37 [PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping Ajay Kaher
2019-05-22 12:07 ` Jason Gunthorpe
2019-06-06 10:25   ` Ajay Kaher
2019-06-06 13:01     ` Jason Gunthorpe
2019-06-06 13:50       ` Ajay Kaher

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org stable@archiver.kernel.org
	public-inbox-index stable


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/ public-inbox