stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Alexander Egorenkov <egorenar@linux.ibm.com>,
	Gerald Schaefer <gerald.schaefer@linux.ibm.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Andrea Arcangeli <aarcange@redhat.com>,
	Heiko Carstens <hca@linux.ibm.com>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.19 91/91] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
Date: Mon, 23 Nov 2020 13:22:51 +0100	[thread overview]
Message-ID: <20201123121813.744695905@linuxfoundation.org> (raw)
In-Reply-To: <20201123121809.285416732@linuxfoundation.org>

From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>

commit bfe8cc1db02ab243c62780f17fc57f65bde0afe1 upstream.

Alexander reported a syzkaller / KASAN finding on s390, see below for
complete output.

In do_huge_pmd_anonymous_page(), the pre-allocated pagetable will be
freed in some cases.  In the case of userfaultfd_missing(), this will
happen after calling handle_userfault(), which might have released the
mmap_lock.  Therefore, the following pte_free(vma->vm_mm, pgtable) will
access an unstable vma->vm_mm, which could have been freed or re-used
already.

For all architectures other than s390 this will go w/o any negative
impact, because pte_free() simply frees the page and ignores the
passed-in mm.  The implementation for SPARC32 would also access
mm->page_table_lock for pte_free(), but there is no THP support in
SPARC32, so the buggy code path will not be used there.

For s390, the mm->context.pgtable_list is being used to maintain the 2K
pagetable fragments, and operating on an already freed or even re-used
mm could result in various more or less subtle bugs due to list /
pagetable corruption.

Fix this by calling pte_free() before handle_userfault(), similar to how
it is already done in __do_huge_pmd_anonymous_page() for the WRITE /
non-huge_zero_page case.

Commit 6b251fc96cf2c ("userfaultfd: call handle_userfault() for
userfaultfd_missing() faults") actually introduced both, the
do_huge_pmd_anonymous_page() and also __do_huge_pmd_anonymous_page()
changes wrt to calling handle_userfault(), but only in the latter case
it put the pte_free() before calling handle_userfault().

  BUG: KASAN: use-after-free in do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744
  Read of size 8 at addr 00000000962d6988 by task syz-executor.0/9334

  CPU: 1 PID: 9334 Comm: syz-executor.0 Not tainted 5.10.0-rc1-syzkaller-07083-g4c9720875573 #0
  Hardware name: IBM 3906 M04 701 (KVM/Linux)
  Call Trace:
    do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744
    create_huge_pmd mm/memory.c:4256 [inline]
    __handle_mm_fault+0xe6e/0x1068 mm/memory.c:4480
    handle_mm_fault+0x288/0x748 mm/memory.c:4607
    do_exception+0x394/0xae0 arch/s390/mm/fault.c:479
    do_dat_exception+0x34/0x80 arch/s390/mm/fault.c:567
    pgm_check_handler+0x1da/0x22c arch/s390/kernel/entry.S:706
    copy_from_user_mvcos arch/s390/lib/uaccess.c:111 [inline]
    raw_copy_from_user+0x3a/0x88 arch/s390/lib/uaccess.c:174
    _copy_from_user+0x48/0xa8 lib/usercopy.c:16
    copy_from_user include/linux/uaccess.h:192 [inline]
    __do_sys_sigaltstack kernel/signal.c:4064 [inline]
    __s390x_sys_sigaltstack+0xc8/0x240 kernel/signal.c:4060
    system_call+0xe0/0x28c arch/s390/kernel/entry.S:415

  Allocated by task 9334:
    slab_alloc_node mm/slub.c:2891 [inline]
    slab_alloc mm/slub.c:2899 [inline]
    kmem_cache_alloc+0x118/0x348 mm/slub.c:2904
    vm_area_dup+0x9c/0x2b8 kernel/fork.c:356
    __split_vma+0xba/0x560 mm/mmap.c:2742
    split_vma+0xca/0x108 mm/mmap.c:2800
    mlock_fixup+0x4ae/0x600 mm/mlock.c:550
    apply_vma_lock_flags+0x2c6/0x398 mm/mlock.c:619
    do_mlock+0x1aa/0x718 mm/mlock.c:711
    __do_sys_mlock2 mm/mlock.c:738 [inline]
    __s390x_sys_mlock2+0x86/0xa8 mm/mlock.c:728
    system_call+0xe0/0x28c arch/s390/kernel/entry.S:415

  Freed by task 9333:
    slab_free mm/slub.c:3142 [inline]
    kmem_cache_free+0x7c/0x4b8 mm/slub.c:3158
    __vma_adjust+0x7b2/0x2508 mm/mmap.c:960
    vma_merge+0x87e/0xce0 mm/mmap.c:1209
    userfaultfd_release+0x412/0x6b8 fs/userfaultfd.c:868
    __fput+0x22c/0x7a8 fs/file_table.c:281
    task_work_run+0x200/0x320 kernel/task_work.c:151
    tracehook_notify_resume include/linux/tracehook.h:188 [inline]
    do_notify_resume+0x100/0x148 arch/s390/kernel/signal.c:538
    system_call+0xe6/0x28c arch/s390/kernel/entry.S:416

  The buggy address belongs to the object at 00000000962d6948 which belongs to the cache vm_area_struct of size 200
  The buggy address is located 64 bytes inside of 200-byte region [00000000962d6948, 00000000962d6a10)
  The buggy address belongs to the page: page:00000000313a09fe refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x962d6 flags: 0x3ffff00000000200(slab)
  raw: 3ffff00000000200 000040000257e080 0000000c0000000c 000000008020ba00
  raw: 0000000000000000 000f001e00000000 ffffffff00000001 0000000096959501
  page dumped because: kasan: bad access detected
  page->mem_cgroup:0000000096959501

  Memory state around the buggy address:
   00000000962d6880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   00000000962d6900: 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
  >00000000962d6980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                        ^
   00000000962d6a00: fb fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00
   00000000962d6a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ==================================================================

Fixes: 6b251fc96cf2c ("userfaultfd: call handle_userfault() for userfaultfd_missing() faults")
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: <stable@vger.kernel.org>	[4.3+]
Link: https://lkml.kernel.org/r/20201110190329.11920-1-gerald.schaefer@linux.ibm.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/huge_memory.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -694,7 +694,6 @@ vm_fault_t do_huge_pmd_anonymous_page(st
 			transparent_hugepage_use_zero_page()) {
 		pgtable_t pgtable;
 		struct page *zero_page;
-		bool set;
 		vm_fault_t ret;
 		pgtable = pte_alloc_one(vma->vm_mm, haddr);
 		if (unlikely(!pgtable))
@@ -707,25 +706,25 @@ vm_fault_t do_huge_pmd_anonymous_page(st
 		}
 		vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
 		ret = 0;
-		set = false;
 		if (pmd_none(*vmf->pmd)) {
 			ret = check_stable_address_space(vma->vm_mm);
 			if (ret) {
 				spin_unlock(vmf->ptl);
+				pte_free(vma->vm_mm, pgtable);
 			} else if (userfaultfd_missing(vma)) {
 				spin_unlock(vmf->ptl);
+				pte_free(vma->vm_mm, pgtable);
 				ret = handle_userfault(vmf, VM_UFFD_MISSING);
 				VM_BUG_ON(ret & VM_FAULT_FALLBACK);
 			} else {
 				set_huge_zero_page(pgtable, vma->vm_mm, vma,
 						   haddr, vmf->pmd, zero_page);
 				spin_unlock(vmf->ptl);
-				set = true;
 			}
-		} else
+		} else {
 			spin_unlock(vmf->ptl);
-		if (!set)
 			pte_free(vma->vm_mm, pgtable);
+		}
 		return ret;
 	}
 	gfp = alloc_hugepage_direct_gfpmask(vma);



  parent reply	other threads:[~2020-11-23 13:25 UTC|newest]

Thread overview: 99+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-23 12:21 [PATCH 4.19 00/91] 4.19.160-rc1 review Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 01/91] ah6: fix error return code in ah6_input() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 02/91] atm: nicstar: Unmap DMA on send error Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 03/91] bnxt_en: read EEPROM A2h address using page 0 Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 04/91] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 05/91] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 06/91] lan743x: fix issue causing intermittent kernel log warnings Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 07/91] lan743x: prevent entire kernel HANG on open, for some platforms Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 08/91] mlxsw: core: Use variable timeout for EMAD retries Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 09/91] net: b44: fix error return code in b44_init_one() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 10/91] net: bridge: add missing counters to ndo_get_stats64 callback Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 11/91] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 12/91] net: Have netpoll bring-up DSA management interface Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 13/91] netlabel: fix our progress tracking in netlbl_unlabel_staticlist() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 14/91] netlabel: fix an uninitialized warning " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 15/91] net/mlx4_core: Fix init_hca fields offset Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 16/91] net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 17/91] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 18/91] page_frag: Recover from memory pressure Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 19/91] qed: fix error return code in qed_iwarp_ll2_start() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 20/91] qlcnic: fix error return code in qlcnic_83xx_restart_hw() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 21/91] sctp: change to hold/put transport for proto_unreach_timer Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 22/91] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 23/91] net/mlx5: Disable QoS when min_rates on all VFs are zero Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 24/91] net: usb: qmi_wwan: Set DTR quirk for MR400 Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 25/91] net/ncsi: Fix netlink registration Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 26/91] net: ftgmac100: Fix crash when removing driver Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 27/91] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 28/91] scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 29/91] selftests: kvm: Fix the segment descriptor layout to match the actual layout Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 30/91] ACPI: button: Add DMI quirk for Medion Akoya E2228T Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 31/91] arm64: psci: Avoid printing in cpu_psci_cpu_die() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 32/91] vfs: remove lockdep bogosity in __sb_start_write Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 33/91] arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 34/91] arm64: dts: allwinner: h5: OrangePi PC2: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 35/91] ARM: dts: sun8i: r40: bananapi-m2-ultra: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 36/91] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 37/91] ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 38/91] ARM: dts: sun8i: a83t: Enable both " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.19 39/91] arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 40/91] Input: adxl34x - clean up a data type in adxl34x_probe() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 41/91] MIPS: export has_transparent_hugepage() for modules Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 42/91] arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 43/91] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 44/91] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 45/91] Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 46/91] perf lock: Dont free "lock_seq_stat" if read_count isnt zero Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 47/91] ip_tunnels: Set tunnel option flag when tunnel metadata is present Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 48/91] can: af_can: prevent potential access of uninitialized member in can_rcv() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 49/91] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 50/91] can: dev: can_restart(): post buffer from the right context Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 51/91] can: ti_hecc: Fix memleak in ti_hecc_probe Greg Kroah-Hartman
2020-11-24 22:52   ` Pavel Machek
2020-11-23 12:22 ` [PATCH 4.19 52/91] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 53/91] can: peak_usb: fix potential integer overflow on shift of a int Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 54/91] can: m_can: m_can_handle_state_change(): fix state change Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 55/91] ASoC: qcom: lpass-platform: Fix memory leak Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 56/91] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 57/91] drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 58/91] can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 59/91] xfs: fix the minrecs logic when dealing with inode root child blocks Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 60/91] xfs: strengthen rmap record flags checking Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 61/91] regulator: ti-abb: Fix array out of bound read access on the first transition Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 62/91] fail_function: Remove a redundant mutex unlock Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 63/91] xfs: revert "xfs: fix rmap key and record comparison functions" Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 64/91] efi/x86: Free efi_pgd with free_pages() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 65/91] libfs: fix error cast of negative value in simple_attr_write() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 66/91] speakup: Do not let the line discipline be used several times Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 67/91] ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 68/91] ALSA: usb-audio: Add delay quirk for all Logitech USB devices Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 69/91] ALSA: ctl: fix error path at adding user-defined element set Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 70/91] ALSA: mixart: Fix mutex deadlock Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 71/91] ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 72/91] tty: serial: imx: keep console clocks always on Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 73/91] efivarfs: fix memory leak in efivarfs_create() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 74/91] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 75/91] ext4: fix bogus warning in ext4_update_dx_flag() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 76/91] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 77/91] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 78/91] regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 79/91] regulator: fix memory leak with repeated set_machine_constraints() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 80/91] regulator: avoid resolve_supply() infinite recursion Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 81/91] regulator: workaround self-referent regulators Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 82/91] xtensa: disable preemption around cache alias management calls Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 83/91] mac80211: minstrel: remove deferred sampling code Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 84/91] mac80211: minstrel: fix tx status processing corner case Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 85/91] mac80211: free sta in sta_info_insert_finish() on errors Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 86/91] s390/cpum_sf.c: fix file permission for cpum_sfb_size Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 87/91] s390/dasd: fix null pointer dereference for ERP requests Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 88/91] ptrace: Set PF_SUPERPRIV when checking capability Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 89/91] seccomp: " Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.19 90/91] x86/microcode/intel: Check patch signature before saving microcode for early loading Greg Kroah-Hartman
2020-11-23 12:22 ` Greg Kroah-Hartman [this message]
2020-11-23 20:54 ` [PATCH 4.19 00/91] 4.19.160-rc1 review Jon Hunter
2020-11-23 22:36 ` Guenter Roeck
2020-11-24  0:32 ` Shuah Khan
2020-11-24  6:55 ` Naresh Kamboju
2020-11-24 19:53 ` Pavel Machek
2020-11-24 20:27   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201123121813.744695905@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=aarcange@redhat.com \
    --cc=akpm@linux-foundation.org \
    --cc=egorenar@linux.ibm.com \
    --cc=gerald.schaefer@linux.ibm.com \
    --cc=hca@linux.ibm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    --subject='Re: [PATCH 4.19 91/91] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox