search for: copy_from_user_mm

...the memory of an oom victim which shares mm with the vhost kernel thread because it could see a zero page unexpectedly and theoretically make an incorrect decision visible outside of the killed task context. Make sure that each place which can read from userspace is annotated properly and it uses copy_from_user_mm, __get_user_mm resp. copy_from_iter_mm. Each will get the target mm as an argument and it performs a pessimistic check to rule out that the oom_reaper could possibly unmap the particular page. __oom_reap_task then just needs to mark the mm as unstable before it unmaps any page. This is a preparato...

...the memory of an oom victim which shares mm with the vhost kernel thread because it could see a zero page unexpectedly and theoretically make an incorrect decision visible outside of the killed task context. Make sure that each place which can read from userspace is annotated properly and it uses copy_from_user_mm, __get_user_mm resp. copy_from_iter_mm. Each will get the target mm as an argument and it performs a pessimistic check to rule out that the oom_reaper could possibly unmap the particular page. __oom_reap_task then just needs to mark the mm as unstable before it unmaps any page. This is a preparato...

...hich > shares mm with the vhost kernel thread because it could see a zero > page unexpectedly and theoretically make an incorrect decision visible > outside of the killed task context. > > Make sure that each place which can read from userspace is annotated > properly and it uses copy_from_user_mm, __get_user_mm resp. > copy_from_iter_mm. Each will get the target mm as an argument and it > performs a pessimistic check to rule out that the oom_reaper could > possibly unmap the particular page. __oom_reap_task then just needs to > mark the mm as unstable before it unmaps any page....

...like this now. Is this such a hot path that something like this would make a visible difference? > > > > > + ___gu_err = -EFAULT; \ > > + ___gu_err; \ > > +}) > > + > > +/* similar to __get_user_mm */ > > +static inline __must_check long __copy_from_user_mm(struct mm_struct *mm, > > + void *to, const void __user * from, unsigned long n) > > +{ > > + long ret = __copy_from_user(to, from, n); > > + if (!ret && test_bit(MMF_UNSTABLE, &mm->flags)) > > + return -EFAULT; > > + return ret; And I've ju...

...like this now. Is this such a hot path that something like this would make a visible difference? > > > > > + ___gu_err = -EFAULT; \ > > + ___gu_err; \ > > +}) > > + > > +/* similar to __get_user_mm */ > > +static inline __must_check long __copy_from_user_mm(struct mm_struct *mm, > > + void *to, const void __user * from, unsigned long n) > > +{ > > + long ret = __copy_from_user(to, from, n); > > + if (!ret && test_bit(MMF_UNSTABLE, &mm->flags)) > > + return -EFAULT; > > + return ret; And I've ju...