mm: replace vma_lock_anon_vma with anon_vma_lock_read/write
commit 12352d3cae2cebe18805a91fab34b534d7444231 upstream. Sequence vma_lock_anon_vma() - vma_unlock_anon_vma() isn't safe if anon_vma appeared between lock and unlock. We have to check anon_vma first or call anon_vma_prepare() to be sure that it's here. There are only few users of these legacy helpers. Let's get rid of them. This patch fixes anon_vma lock imbalance in validate_mm(). Write lock isn't required here, read lock is enough. And reorders expand_downwards/expand_upwards: security_mmap_addr() and wrapping-around check don't have to be under anon vma lock. Link: https://lkml.kernel.org/r/CACT4Y+Y908EjM2z=706dv4rV6dWtxTLK9nFg9_7DhRMLppBo2g@mail.gmail.com Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [ luis: backported to 3.16: adjusted context ] Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
This commit is contained in:
parent
e73e360cec
commit
dcc50253a9
|
@ -119,20 +119,6 @@ static inline struct anon_vma *page_anon_vma(struct page *page)
|
|||
return page_rmapping(page);
|
||||
}
|
||||
|
||||
static inline void vma_lock_anon_vma(struct vm_area_struct *vma)
|
||||
{
|
||||
struct anon_vma *anon_vma = vma->anon_vma;
|
||||
if (anon_vma)
|
||||
down_write(&anon_vma->root->rwsem);
|
||||
}
|
||||
|
||||
static inline void vma_unlock_anon_vma(struct vm_area_struct *vma)
|
||||
{
|
||||
struct anon_vma *anon_vma = vma->anon_vma;
|
||||
if (anon_vma)
|
||||
up_write(&anon_vma->root->rwsem);
|
||||
}
|
||||
|
||||
static inline void anon_vma_lock_write(struct anon_vma *anon_vma)
|
||||
{
|
||||
down_write(&anon_vma->root->rwsem);
|
||||
|
|
21
mm/mmap.c
21
mm/mmap.c
|
@ -443,11 +443,16 @@ static void validate_mm(struct mm_struct *mm)
|
|||
unsigned long highest_address = 0;
|
||||
struct vm_area_struct *vma = mm->mmap;
|
||||
while (vma) {
|
||||
struct anon_vma *anon_vma = vma->anon_vma;
|
||||
struct anon_vma_chain *avc;
|
||||
vma_lock_anon_vma(vma);
|
||||
|
||||
if (anon_vma) {
|
||||
anon_vma_lock_read(anon_vma);
|
||||
list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
|
||||
anon_vma_interval_tree_verify(avc);
|
||||
vma_unlock_anon_vma(vma);
|
||||
anon_vma_unlock_read(anon_vma);
|
||||
}
|
||||
|
||||
highest_address = vm_end_gap(vma);
|
||||
vma = vma->vm_next;
|
||||
i++;
|
||||
|
@ -2224,7 +2229,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
|
|||
* is required to hold the mmap_sem in read mode. We need the
|
||||
* anon_vma lock to serialize against concurrent expand_stacks.
|
||||
*/
|
||||
vma_lock_anon_vma(vma);
|
||||
anon_vma_lock_write(vma->anon_vma);
|
||||
|
||||
/* Somebody else might have raced and expanded it already */
|
||||
if (address > vma->vm_end) {
|
||||
|
@ -2242,7 +2247,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
|
|||
* updates, but we only hold a shared mmap_sem
|
||||
* lock here, so we need to protect against
|
||||
* concurrent vma expansions.
|
||||
* vma_lock_anon_vma() doesn't help here, as
|
||||
* anon_vma_lock_write() doesn't help here, as
|
||||
* we don't guarantee that all growable vmas
|
||||
* in a mm share the same root anon vma.
|
||||
* So, we reuse mm->page_table_lock to guard
|
||||
|
@ -2262,7 +2267,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
|
|||
}
|
||||
}
|
||||
}
|
||||
vma_unlock_anon_vma(vma);
|
||||
anon_vma_unlock_write(vma->anon_vma);
|
||||
khugepaged_enter_vma_merge(vma, vma->vm_flags);
|
||||
validate_mm(vma->vm_mm);
|
||||
return error;
|
||||
|
@ -2305,7 +2310,7 @@ int expand_downwards(struct vm_area_struct *vma,
|
|||
* is required to hold the mmap_sem in read mode. We need the
|
||||
* anon_vma lock to serialize against concurrent expand_stacks.
|
||||
*/
|
||||
vma_lock_anon_vma(vma);
|
||||
anon_vma_lock_write(vma->anon_vma);
|
||||
|
||||
/* Somebody else might have raced and expanded it already */
|
||||
if (address < vma->vm_start) {
|
||||
|
@ -2323,7 +2328,7 @@ int expand_downwards(struct vm_area_struct *vma,
|
|||
* updates, but we only hold a shared mmap_sem
|
||||
* lock here, so we need to protect against
|
||||
* concurrent vma expansions.
|
||||
* vma_lock_anon_vma() doesn't help here, as
|
||||
* anon_vma_lock_write() doesn't help here, as
|
||||
* we don't guarantee that all growable vmas
|
||||
* in a mm share the same root anon vma.
|
||||
* So, we reuse mm->page_table_lock to guard
|
||||
|
@ -2341,7 +2346,7 @@ int expand_downwards(struct vm_area_struct *vma,
|
|||
}
|
||||
}
|
||||
}
|
||||
vma_unlock_anon_vma(vma);
|
||||
anon_vma_unlock_write(vma->anon_vma);
|
||||
khugepaged_enter_vma_merge(vma, vma->vm_flags);
|
||||
validate_mm(vma->vm_mm);
|
||||
return error;
|
||||
|
|
Loading…
Reference in New Issue