The patch titled
Subject: mmap locking API: don't check locking if the mm isn't live yet
has been added to the -mm tree. Its filename is
mmap-locking-api-dont-check-locking-if-the-mm-isnt-live-yet.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mmap-locking-api-dont-check-locking-if-the-mm-isnt-live-yet.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mmap-locking-api-dont-check-locking-if-the-mm-isnt-live-yet.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Jann Horn <jannh@xxxxxxxxxx>
Subject: mmap locking API: don't check locking if the mm isn't live yet
In preparation for adding a mmap_assert_locked() check in
__get_user_pages(), teach the mmap_assert_*locked() helpers that it's fine
to operate on an mm without locking in the middle of execve() as long as
it hasn't been installed on a process yet.
Existing code paths that do this are (reverse callgraph):
get_user_pages_remote
get_arg_page
copy_strings
copy_string_kernel
remove_arg_zero
tomoyo_dump_page
tomoyo_print_bprm
tomoyo_scan_bprm
tomoyo_environ
Link: https://lkml.kernel.org/r/CAG48ez03YJG9JU_6tGiMcaVjuTyRE_o4LEQ7901b5ZoCnNAjcg@xxxxxxxxxxxxxx
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
Cc: "Eric W . Biederman" <ebiederm@xxxxxxxxxxxx>
Cc: Jason Gunthorpe <jgg@xxxxxxxxxx>
Cc: John Hubbard <jhubbard@xxxxxxxxxx>
Cc: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
Cc: Michel Lespinasse <walken@xxxxxxxxxx>
Cc: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/exec.c | 8 ++++++++
include/linux/mm_types.h | 10 ++++++++++
include/linux/mmap_lock.h | 16 ++++++++++++----
3 files changed, 30 insertions(+), 4 deletions(-)
--- a/fs/exec.c~mmap-locking-api-dont-check-locking-if-the-mm-isnt-live-yet
+++ a/fs/exec.c
@@ -1129,6 +1129,14 @@ static int exec_mmap(struct mm_struct *m
}
}
+#if defined(CONFIG_LOCKDEP) || defined(CONFIG_DEBUG_VM)
+ /*
+ * From here on, the mm may be accessed concurrently, and proper locking
+ * is required for things like get_user_pages_remote().
+ */
+ mm->mmap_lock_required = 1;
+#endif
+
task_lock(tsk);
membarrier_exec_mmap(mm);
--- a/include/linux/mmap_lock.h~mmap-locking-api-dont-check-locking-if-the-mm-isnt-live-yet
+++ a/include/linux/mmap_lock.h
@@ -77,14 +77,22 @@ static inline void mmap_read_unlock_non_
static inline void mmap_assert_locked(struct mm_struct *mm)
{
- lockdep_assert_held(&mm->mmap_lock);
- VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm);
+#if defined(CONFIG_LOCKDEP) || defined(CONFIG_DEBUG_VM)
+ if (mm->mmap_lock_required) {
+ lockdep_assert_held(&mm->mmap_lock);
+ VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm);
+ }
+#endif
}
static inline void mmap_assert_write_locked(struct mm_struct *mm)
{
- lockdep_assert_held_write(&mm->mmap_lock);
- VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm);
+#if defined(CONFIG_LOCKDEP) || defined(CONFIG_DEBUG_VM)
+ if (mm->mmap_lock_required) {
+ lockdep_assert_held_write(&mm->mmap_lock);
+ VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm);
+ }
+#endif
}
static inline int mmap_lock_is_contended(struct mm_struct *mm)
--- a/include/linux/mm_types.h~mmap-locking-api-dont-check-locking-if-the-mm-isnt-live-yet
+++ a/include/linux/mm_types.h
@@ -556,6 +556,16 @@ struct mm_struct {
#ifdef CONFIG_IOMMU_SUPPORT
u32 pasid;
#endif
+
+#if defined(CONFIG_LOCKDEP) || defined(CONFIG_DEBUG_VM)
+ /*
+ * Notes whether this mm has been installed on a process yet.
+ * If not, only the task going through execve() can access this
+ * mm, and no locking is needed around get_user_pages_remote().
+ * This flag is only used for debug checks.
+ */
+ bool mmap_lock_required;
+#endif
} __randomize_layout;
/*
_
Patches currently in -mm which might be from jannh@xxxxxxxxxx are
mm-mmu_notifier-fix-mmget-assert-in-__mmu_interval_notifier_insert.patch
binfmt_elf_fdpic-stop-using-dump_emit-on-user-pointers-on-mmu.patch
coredump-let-dump_emit-bail-out-on-short-writes.patch
coredump-refactor-page-range-dumping-into-common-helper.patch
coredump-rework-elf-elf_fdpic-vma_dump_size-into-common-helper.patch
binfmt_elf-binfmt_elf_fdpic-use-a-vma-list-snapshot.patch
mm-gup-take-mmap_lock-in-get_dump_page.patch
mm-remove-the-now-unnecessary-mmget_still_valid-hack.patch
mm-gup_benchmark-take-the-mmap-lock-around-gup.patch
binfmt_elf-take-the-mmap-lock-around-find_extend_vma.patch
mmap-locking-api-dont-check-locking-if-the-mm-isnt-live-yet.patch
mm-gup-assert-that-the-mmap-lock-is-held-in-__get_user_pages.patch
