I learnt, it's, alas, too late to drop the non PRCTL_SET_MM_MAP calls [1], so at least downgrade the write acquisition of mmap_sem as in the patch below (that should be stacked on the previous one or squashed). Cyrill, you mentioned lock changes in [1] but the link seems empty. Is it supposed to be [2]? That could be an alternative to this patch after some refreshments and clarifications. [1] https://lore.kernel.org/lkml/20190417165632.GC3040@xxxxxxxxxx/ [2] https://lore.kernel.org/lkml/20180507075606.870903028@xxxxxxxxx/ ======== Since commit 88aa7cc688d4 ("mm: introduce arg_lock to protect arg_start|end and env_start|end in mm_struct") we use arg_lock for boundaries modifications. Synchronize prctl_set_mm with this lock and keep mmap_sem for reading only (analogous to what we already do in prctl_set_mm_map). Also, save few cycles by looking up VMA only after performing basic arguments validation. Signed-off-by: Michal Koutný <mkoutny@xxxxxxxx> --- kernel/sys.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/sys.c b/kernel/sys.c index 12df0e5434b8..bbce0f26d707 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -2125,8 +2125,12 @@ static int prctl_set_mm(int opt, unsigned long addr, error = -EINVAL; - down_write(&mm->mmap_sem); - vma = find_vma(mm, addr); + /* + * arg_lock protects concurent updates of arg boundaries, we need mmap_sem for + * a) concurrent sys_brk, b) finding VMA for addr validation. + */ + down_read(&mm->mmap_sem); + spin_lock(&mm->arg_lock); prctl_map.start_code = mm->start_code; prctl_map.end_code = mm->end_code; @@ -2185,6 +2189,7 @@ static int prctl_set_mm(int opt, unsigned long addr, if (error) goto out; + vma = find_vma(mm, addr); switch (opt) { /* * If command line arguments and environment @@ -2218,7 +2223,8 @@ static int prctl_set_mm(int opt, unsigned long addr, error = 0; out: - up_write(&mm->mmap_sem); + spin_unlock(&mm->arg_lock); + up_read(&mm->mmap_sem); return error; } -- 2.16.4
