search for: mmu_notifier_regist

On Tue, Jul 23, 2019 at 03:57:14AM -0400, Jason Wang wrote: > The return value of mmu_notifier_register() is not checked in > vhost_vring_set_num_addr(). This will cause an out of sync between mm > and MMU notifier thus a double free. To solve this, introduce a > boolean flag to track whether MMU notifier is registered and only do > unregistering when it was true. > > Reported-an...

The return value of mmu_notifier_register() is not checked in vhost_vring_set_num_addr(). This will cause an out of sync between mm and MMU notifier thus a double free. To solve this, introduce a boolean flag to track whether MMU notifier is registered and only do unregistering when it was true. Reported-and-tested-by: syzbot+e58112d71f...

Hi all: This series try to fix several issues introduced by meta data accelreation series. Please review. Jason Wang (6): vhost: don't set uaddr for invalid address vhost: validate MMU notifier registration vhost: fix vhost map leak vhost: reset invalidate_count in vhost_set_vring_num_addr() vhost: mark dirty pages during map uninit vhost: don't do synchronize_rcu() in

...hes zero + * in mmdrop(). + */ +struct mmu_notifier_mm { + /* all mmu notifiers registered in this mm are queued in this list */ + struct hlist_head list; + /* to serialize the list modifications and hlist_unhashed */ + spinlock_t lock; +}; + /* * This function can't run concurrently against mmu_notifier_register * because mm->mm_users > 0 during mmu_notifier_register and exit_mmap -- 2.23.0

...hes zero + * in mmdrop(). + */ +struct mmu_notifier_mm { + /* all mmu notifiers registered in this mm are queued in this list */ + struct hlist_head list; + /* to serialize the list modifications and hlist_unhashed */ + spinlock_t lock; +}; + /* * This function can't run concurrently against mmu_notifier_register * because mm->mm_users > 0 during mmu_notifier_register and exit_mmap -- 2.24.0

...+struct mmu_range_notifier { + struct interval_tree_node interval_tree; + const struct mmu_range_notifier_ops *ops; + struct hlist_node deferred_item; + unsigned long invalidate_seq; + struct mm_struct *mm; +}; + #ifdef CONFIG_MMU_NOTIFIER #ifdef CONFIG_LOCKDEP @@ -263,6 +289,78 @@ extern int __mmu_notifier_register(struct mmu_notifier *mn, struct mm_struct *mm); extern void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm); + +unsigned long mmu_range_read_begin(struct mmu_range_notifier *mrn); +int mmu_range_notifier_insert(struct mmu_range_notifier *mrn, + uns...

...t mmu_interval_notifier { + struct interval_tree_node interval_tree; + const struct mmu_interval_notifier_ops *ops; + struct mm_struct *mm; + struct hlist_node deferred_item; + unsigned long invalidate_seq; +}; + #ifdef CONFIG_MMU_NOTIFIER #ifdef CONFIG_LOCKDEP @@ -263,6 +289,81 @@ extern int __mmu_notifier_register(struct mmu_notifier *mn, struct mm_struct *mm); extern void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm); + +unsigned long mmu_interval_read_begin(struct mmu_interval_notifier *mni); +int mmu_interval_notifier_insert(struct mmu_interval_notifier *mni, +...

...++++++++-- > 3 files changed, 607 insertions(+), 25 deletions(-) > [snip] > diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c > index 367670cfd02b7b..d02d3c8c223eb7 100644 > --- a/mm/mmu_notifier.c > +++ b/mm/mmu_notifier.c [snip] > * because mm->mm_users > 0 during mmu_notifier_register and exit_mmap > @@ -52,17 +286,24 @@ struct mmu_notifier_mm { > * can't go away from under us as exit_mmap holds an mm_count pin > * itself. > */ > -void __mmu_notifier_release(struct mm_struct *mm) > +static void mn_hlist_release(struct mmu_notifier_mm *mmn_mm, &gt...

...mu_notifier_mm { > + /* all mmu notifiers registered in this mm are queued in this list */ > + struct hlist_head list; > + /* to serialize the list modifications and hlist_unhashed */ > + spinlock_t lock; > +}; > + > /* > * This function can't run concurrently against mmu_notifier_register > * because mm->mm_users > 0 during mmu_notifier_register and exit_mmap >

Hi all: This series try to fix several issues introduced by meta data accelreation series. Please review. Changes from V2: - use seqlck helper to synchronize MMU notifier with vhost worker Changes from V1: - try not use RCU to syncrhonize MMU notifier with vhost worker - set dirty pages after no readers - return -EAGAIN only when we find the range is overlapped with metadata Jason Wang (9):

Hi all: This series try to fix several issues introduced by meta data accelreation series. Please review. Changes from V4: - switch to use spinlock synchronize MMU notifier with accessors Changes from V3: - remove the unnecessary patch Changes from V2: - use seqlck helper to synchronize MMU notifier with vhost worker Changes from V1: - try not use RCU to syncrhonize MMU notifier with vhost

Hi all: This series try to fix several issues introduced by meta data accelreation series. Please review. Changes from V4: - switch to use spinlock synchronize MMU notifier with accessors Changes from V3: - remove the unnecessary patch Changes from V2: - use seqlck helper to synchronize MMU notifier with vhost worker Changes from V1: - try not use RCU to syncrhonize MMU notifier with vhost

Hi all: This series try to fix several issues introduced by meta data accelreation series. Please review. Changes from V3: - remove the unnecessary patch Changes from V2: - use seqlck helper to synchronize MMU notifier with vhost worker Changes from V1: - try not use RCU to syncrhonize MMU notifier with vhost worker - set dirty pages after no readers - return -EAGAIN only when we find the

Hi all: This series try to fix several issues introduced by meta data accelreation series. Please review. Changes from V3: - remove the unnecessary patch Changes from V2: - use seqlck helper to synchronize MMU notifier with vhost worker Changes from V1: - try not use RCU to syncrhonize MMU notifier with vhost worker - set dirty pages after no readers - return -EAGAIN only when we find the

.../* Caller should have device mutex */ > long vhost_dev_set_owner(struct vhost_dev *dev) > { > @@ -541,7 +611,14 @@ long vhost_dev_set_owner(struct vhost_dev *dev) > if (err) > goto err_cgroup; > > + dev->mmu_notifier.ops = &vhost_mmu_notifier_ops; > + err = mmu_notifier_register(&dev->mmu_notifier, dev->mm); > + if (err) > + goto err_mmu_notifier; > + > return 0; > +err_mmu_notifier: > + vhost_dev_free_iovecs(dev); > err_cgroup: > kthread_stop(worker); > dev->worker = NULL; > @@ -632,6 +709,72 @@ static void vhost_clear_...

On Tue, Oct 29, 2019 at 10:04:45PM +0000, Kuehling, Felix wrote: > > * because mm->mm_users > 0 during mmu_notifier_register and exit_mmap > > @@ -52,17 +286,24 @@ struct mmu_notifier_mm { > > * can't go away from under us as exit_mmap holds an mm_count pin > > * itself. > > */ > > -void __mmu_notifier_release(struct mm_struct *mm) > > +static void mn_hlist_release(struc...

...t; vhost_vq_reset(dev, vq); > if (vq->handle_kick) > vhost_poll_init(&vq->poll, vq->handle_kick, > @@ -725,18 +564,7 @@ long vhost_dev_set_owner(struct vhost_dev *dev) > if (err) > goto err_cgroup; > > -#if VHOST_ARCH_CAN_ACCEL_UACCESS > - err = mmu_notifier_register(&dev->mmu_notifier, dev->mm); > - if (err) > - goto err_mmu_notifier; > -#endif > - > return 0; > - > -#if VHOST_ARCH_CAN_ACCEL_UACCESS > -err_mmu_notifier: > - vhost_dev_free_iovecs(dev); > -#endif > err_cgroup: > kthread_stop(worker); > d...

...u_notifier_invalidate_range_start, +}; + /* Caller should have device mutex */ long vhost_dev_set_owner(struct vhost_dev *dev) { @@ -541,7 +611,14 @@ long vhost_dev_set_owner(struct vhost_dev *dev) if (err) goto err_cgroup; + dev->mmu_notifier.ops = &vhost_mmu_notifier_ops; + err = mmu_notifier_register(&dev->mmu_notifier, dev->mm); + if (err) + goto err_mmu_notifier; + return 0; +err_mmu_notifier: + vhost_dev_free_iovecs(dev); err_cgroup: kthread_stop(worker); dev->worker = NULL; @@ -632,6 +709,72 @@ static void vhost_clear_msg(struct vhost_dev *dev) spin_unlock(&dev-...

...t;iotlb_lock); -#if VHOST_ARCH_CAN_ACCEL_UACCESS +#ifdef VHOST_ARCH_CAN_ACCEL_UACCESS vhost_init_maps(dev); #endif @@ -726,7 +726,7 @@ long vhost_dev_set_owner(struct vhost_dev *dev) if (err) goto err_cgroup; -#if VHOST_ARCH_CAN_ACCEL_UACCESS +#ifdef VHOST_ARCH_CAN_ACCEL_UACCESS err = mmu_notifier_register(&dev->mmu_notifier, dev->mm); if (err) goto err_mmu_notifier; @@ -734,7 +734,7 @@ long vhost_dev_set_owner(struct vhost_dev *dev) return 0; -#if VHOST_ARCH_CAN_ACCEL_UACCESS +#ifdef VHOST_ARCH_CAN_ACCEL_UACCESS err_mmu_notifier: vhost_dev_free_iovecs(dev); #endif @@ -828,...

...t;iotlb_lock); -#if VHOST_ARCH_CAN_ACCEL_UACCESS +#ifdef VHOST_ARCH_CAN_ACCEL_UACCESS vhost_init_maps(dev); #endif @@ -726,7 +726,7 @@ long vhost_dev_set_owner(struct vhost_dev *dev) if (err) goto err_cgroup; -#if VHOST_ARCH_CAN_ACCEL_UACCESS +#ifdef VHOST_ARCH_CAN_ACCEL_UACCESS err = mmu_notifier_register(&dev->mmu_notifier, dev->mm); if (err) goto err_mmu_notifier; @@ -734,7 +734,7 @@ long vhost_dev_set_owner(struct vhost_dev *dev) return 0; -#if VHOST_ARCH_CAN_ACCEL_UACCESS +#ifdef VHOST_ARCH_CAN_ACCEL_UACCESS err_mmu_notifier: vhost_dev_free_iovecs(dev); #endif @@ -828,...