lkml.org 
[lkml]   [2012]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] mm: Downgrade mmap_sem before locking or populating on mmap
    On Sun, Dec 16, 2012 at 05:04:03PM +0000, Al Viro wrote:

    > That's just from a couple of days of RTFS. The locking in there is far too
    > convoluted as it is; worse, it's not localized code-wise, so rechecking
    > correctness is going to remain a big time-sink ;-/
    >
    > Making it *more* complex doesn't look like a good idea, TBH...

    ... and another fun place: kvm_setup_async_pf() grabs a _passive_ reference
    to current->mm (->mm_count, not ->mm_users), sticks it into work->mm and
    schedules execution of async_pf_execute(). Which does use_mm() (still no
    active refs acquired), grabs work->mm->mmap_sem shared and proceeds to call
    get_user_pages(). What's going to happen if somebody does kill -9 to
    the process that had started that?

    get_user_pages() in parallel with exit_mmap() is a Bad Thing(tm) and I don't
    see anything on the exit path that would've waited for that work to finish.
    I might've missed something here, but... Note that aio (another place
    playing with use_mm(), also without an active ref) has an explicit hook
    for mmput() to call before proceeding to exit_mmap(); I don't see anything
    similar here.

    Not that aio.c approach had been all that safe - get_task_mm() will refuse
    to pick use_mm'ed one, but there are places open-coding it without the
    check for PF_KTHREAD. Few of them, fortunately, but...


    \
     
     \ /
      Last update: 2012-12-16 21:41    [W:3.124 / U:0.800 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site