On 4/14/21 8:51 AM, Sean Christopherson wrote: >> Could this access to and kfree of encl_mm possibly be after the >> kfree(encl_mm) noted above? > No, the mmu_notifier_unregister() ensures that all in-progress notifiers complete > before it returns, i.e. SGX's notifier call back is not reachable after it's > unregistered. > >> Also is there a reason we do kfree(encl_mm) in notifier_free not directly in >> notifier_release? > Because encl_mm is the anchor to the enclave reference > > /* 'encl_mm' is going away, put encl_mm->encl reference: */ > kref_put(&encl_mm->encl->refcount, sgx_encl_release); > > as well as the mmu notifier reference (the mmu_notifier_put(mn) call chain). > Freeing encl_mm immediately would prevent sgx_mmu_notifier_free() from dropping > the enclave reference. And the mmu notifier reference need to be dropped in > sgx_mmu_notifier_release() because the encl_mm has been taken off encl->mm_list. Haitao, I think you've highlighted that this locking scheme is woefully under-documented. Any patches to beef it up would be very welcome.
