On Thu, Apr 09, 2020 at 09:21:34AM -0700, Jacob Pan wrote: > On Thu, 9 Apr 2020 11:25:19 -0300 > Jason Gunthorpe <jgg@xxxxxxxx> wrote: > > > On Thu, Apr 09, 2020 at 07:14:24AM -0700, Jacob Pan wrote: > > > > When the process is killed, mm release can happen before fds are > > > > released. If you look at do_exit() in kernel/exit.c: > > > > > > > > exit_mm() > > > > mmput() > > > > -> mmu release notifier > > > > ... > > > > exit_files() > > > > close_files() > > > > fput() > > > > exit_task_work() > > > > __fput() > > > > -> unbind() > > > > > > > So unbind is coming anyway, the difference in handling in mmu > > > release notifier is whether we silently drop DMA fault vs. > > > reporting fault? > > > > Userspace can significantly delay the final fput triggering the > > unbind, the above is only for the trivial case where the process > > owning the mm_struct is the only process holding the fd. > > > Are you talking about FDs owned buy children after fork() or FDs sent > over to another process. I think, in either case SVA is not supported. Supported or not a hostile user space can trigger these conditions and it should not cause misbehavior from the kernel (eg log spamming) Jason
