Messages in this thread | | | Date | Sat, 2 Mar 2019 09:10:43 -0800 | From | Matthew Wilcox <> | Subject | Re: [PATCH] mm/memory.c: do_fault: avoid usage of stale vm_area_struct |
| |
On Sat, Mar 02, 2019 at 04:11:26PM +0100, Jan Stancek wrote: > Problem is that "vmf->vma" used in do_fault() can become stale. > Because mmap_sem may be released, other threads can come in, > call munmap() and cause "vma" be returned to kmem cache, and > get zeroed/re-initialized and re-used:
> This patch pins mm_struct and stores its value, to avoid using > potentially stale "vma" when calling pte_free().
OK, we need to cache the mm_struct, but why do we need the extra atomic op? There's surely no way the mm can be freed while the thread is in the middle of handling a fault.
ie I would drop these lines:
> + mmgrab(vm_mm); > + ... > + > + mmdrop(vm_mm); > +
| |