Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20200212233946.246210-1-minchan@kernel.org> <20200212233946.246210-2-minchan@kernel.org>
 <3f0218093e2d19fa0f24ceff635cbb9ec5ba69ec.camel@linux.intel.com> <20200213170224.GA27817@google.com>
In-Reply-To: <20200213170224.GA27817@google.com>
From:   Jann Horn <jannh@google.com>
Date:   Thu, 13 Feb 2020 18:35:45 +0100
Message-ID: <CAG48ez0EkkKyH9OniR6nWTDejsR-Mqz_c+ywwWT3_X_7-WfTfw@mail.gmail.com>
Subject: Re: [PATCH v4 1/8] mm: pass task to do_madvise
To:     Minchan Kim <minchan@kernel.org>
Cc:     Alexander Duyck <alexander.h.duyck@linux.intel.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        LKML <linux-kernel@vger.kernel.org>,
        linux-mm <linux-mm@kvack.org>,
        Linux API <linux-api@vger.kernel.org>,
        Oleksandr Natalenko <oleksandr@redhat.com>,
        Suren Baghdasaryan <surenb@google.com>,
        Tim Murray <timmurray@google.com>,
        Daniel Colascione <dancol@google.com>,
        Sandeep Patil <sspatil@google.com>,
        Sonny Rao <sonnyrao@google.com>,
        Brian Geffon <bgeffon@google.com>,
        Michal Hocko <mhocko@suse.com>,
        Johannes Weiner <hannes@cmpxchg.org>,
        Shakeel Butt <shakeelb@google.com>,
        John Dias <joaodias@google.com>,
        Joel Fernandes <joel@joelfernandes.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Feb 13, 2020 at 6:02 PM Minchan Kim <minchan@kernel.org> wrote:
> On Wed, Feb 12, 2020 at 04:21:59PM -0800, Alexander Duyck wrote:
> > On Wed, 2020-02-12 at 15:39 -0800, Minchan Kim wrote:
> > > In upcoming patches, do_madvise will be called from external process
> > > context so it shouldn't asssume "current" is always hinted process's
> > > task_struct. Thus, let's get the mm_struct from vma->vm_mm, not
> > > current because vma is always hinted process's one. And let's pass
> > > *current* as new task argument of do_madvise so it shouldn't change
> > > existing behavior.
[...]
> > > @@ -763,8 +763,8 @@ static long madvise_dontneed_free(struct vm_area_struct *vma,
> > >     if (!userfaultfd_remove(vma, start, end)) {
> > >             *prev = NULL; /* mmap_sem has been dropped, prev is stale */
> > >
> > > -           down_read(&current->mm->mmap_sem);
> > > -           vma = find_vma(current->mm, start);
> > > +           down_read(&mm->mmap_sem);
> > > +           vma = find_vma(mm, start);
> > >             if (!vma)
> > >                     return -ENOMEM;
> > >             if (start < vma->vm_start) {
> >
> > This piece of code has me wondering if it is valid to be using vma->mm at
> > the start of the function. I assume we are probably safe since we read the
> > mm value before the semaphore was released in userfaultfd_remove. It might
> > make more sense to just pass the task to the function and use task->mm-
> > >mmap_sem instead.
>
> As Jann pointed out, we couldn't use task->mm once we verified it via
> access_mm. However, I believe vma->vm_mm is safe(Ccing Jann for double
> check).

Looks safe to me, too.