| Message ID | 20200901000143.207585-1-jannh@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | mm/mmu_notifier: Fix mmget() assert in __mmu_interval_notifier_insert | expand |
On Tue, Sep 01, 2020 at 02:01:43AM +0200, Jann Horn wrote: > The comment talks about having to hold mmget() (which means mm_users), but > the actual check is on mm_count (which would be mmgrab()). > > Given that MMU notifiers are torn down in > mmput() -> __mmput() -> exit_mmap() -> mmu_notifier_release(), > I believe that the comment is correct and the check should be on > mm->mm_users. Fix it up accordingly. > > Fixes: 99cb252f5e68 ("mm/mmu_notifier: add an interval tree notifier") > Signed-off-by: Jann Horn <jannh@google.com> > --- > Can someone please double-check this? I'm like 90% sure that I fixed > this the right way around, but it'd be good if someone more familiar > with mmu notifiers could confirm. Hmm.. I added the comment but copied the expression from older code. The intent is certainly that the caller must have a mmget, this function must not race with __mmu_notifier_release() and the mmget is what prevents that. Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Jason
diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c index 4fc918163dd3..5654dd19addc 100644 --- a/mm/mmu_notifier.c +++ b/mm/mmu_notifier.c @@ -913,7 +913,7 @@ static int __mmu_interval_notifier_insert( return -EOVERFLOW; /* Must call with a mmget() held */ - if (WARN_ON(atomic_read(&mm->mm_count) <= 0)) + if (WARN_ON(atomic_read(&mm->mm_users) <= 0)) return -EINVAL; /* pairs with mmdrop in mmu_interval_notifier_remove() */
The comment talks about having to hold mmget() (which means mm_users), but the actual check is on mm_count (which would be mmgrab()). Given that MMU notifiers are torn down in mmput() -> __mmput() -> exit_mmap() -> mmu_notifier_release(), I believe that the comment is correct and the check should be on mm->mm_users. Fix it up accordingly. Fixes: 99cb252f5e68 ("mm/mmu_notifier: add an interval tree notifier") Signed-off-by: Jann Horn <jannh@google.com> --- Can someone please double-check this? I'm like 90% sure that I fixed this the right way around, but it'd be good if someone more familiar with mmu notifiers could confirm. mm/mmu_notifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) base-commit: 15bc20c6af4ceee97a1f90b43c0e386643c071b4