Messages in this thread | | | Date | Fri, 20 Apr 2012 20:58:33 +0100 | From | Al Viro <> | Subject | Re: [RFC] situation with fput() locking (was Re: [PULL REQUEST] : ima-appraisal patches) |
| |
On Fri, Apr 20, 2012 at 12:18:43PM -0700, Linus Torvalds wrote:
> The *bigger* annoyance is actually "do_mmap()", which does a > do_munmap() as part of it, so it needs the same cleanup too.
So does a bunch of other places. Let me dig out the call graph circa 3.3.0... Here is the relevant part: do_munmap() - <- pfm_do_munmap() <- pfm_remove_smpl_mapping() which grabs mmap_sem excl <- 64_munmap(2) which grabs mmap_sem excl <- kvm_arch_commit_memory_region() which grabs mmap_sem excl <- i810_unmap_buffer() which grabs mmap_sem excl <- aio_free_ring() which grabs mmap_sem excl <- elf_map() which grabs mmap_sem excl <- [flat] load_flat_file() --- BUG HERE <- shmdt(2) which grabs mmap_sem excl <- brk(2) which grabs mmap_sem excl <- mmap_region() [see below] <- munmap(2) which grabs mmap_sem excl <- do_brk() [see below] <- move_vma() <- mremap_to() <- do_mremap() [see below] <- do_mremap() [see below] <- mremap_to() <- do_mremap() [see below] <- do_mremap() [see below] do_brk() - <- brk(2) which grabs mmap_sem excl <- [ia32_aout] set_brk() which grabs mmap_sem excl <- [ia32_aout] load_aout_binary() which grabs mmap_sem excl <- [ia32_aout] load_aout_library() which grabs mmap_sem excl <- [aout] set_brk() which grabs mmap_sem excl <- [aout] load_aout_binary() which grabs mmap_sem excl <- [aout] load_aout_library() which grabs mmap_sem excl <- [elf] set_brk() which grabs mmap_sem excl <- [elf] load_elf_interp() which grabs mmap_sem excl <- [elf] load_elf_library() which grabs mmap_sem excl mmap_region() - <- remap_file_pages(2) which grabs mmap_sem excl <- do_mmap_pgoff() [see below] <- [tile] arch_setup_additional_pages() which grabs mmap_sem excl (a bit too late, BTW, but not for this one) do_mmap_pgoff() - <- do_mmap() [see below] <- mmap_pgoff(2) which grabs mmap_sem excl do_mmap() - <- shmat(2) which grabs mmap_sem excl <- aio_setup_ring() which grabs mmap_sem excl [NB: only because ctx->mm == current->mm] <- kvm_arch_prepare_memory_region() which grabs mmap_sem excl <- drm_mapbufs() which grabs mmap_sem excl <- exynos_drm_gem_mmap_ioctl() which grabs mmap_sem excl <- i810_map_buffer() which grabs mmap_sem excl [NB: racy changes of ->f_op] <- i915_gem_mmap_ioctl() which grabs mmap_sem excl <- [tile] single_step_once() which grabs mmap_sem excl <- [elf] elf_map() which grabs mmap_sem excl <- [elf] load_elf_binary() which grabs mmap_sem excl <- [elf_fdpic] load_elf_fdpic_binary() which grabs mmap_sem excl <- [elf_fdpic] elf_fdpic_map_file_constdisp_on_uclinux() which grabs mmap_sem excl <- [elf_fdpic] elf_fdpic_map_file_by_direct_mmap() which grabs mmap_sem excl <- [aout] load_aout_binary() which grabs mmap_sem excl <- [aout] load_aout_library() which grabs mmap_sem excl <- [ia32_aout] load_aout_binary() which grabs mmap_sem excl <- [ia32_aout] load_aout_library() which grabs mmap_sem excl <- [flat] load_flat_file() which grabs mmap_sem excl <- [som] map_som_binary() which grabs mmap_sem excl do_mremap() - <- mremap(2) which grabs mmap_sem excl
(bug mentioned re load_flat_file() is still there, but it's irrelevant for our purposes - no ->mmap_sem held by caller of do_munmap()). That's a metric arseload of sites to propagate that thing to...
| |