queue-5.1/coredump-fix-race-condition-between-collapse_huge_page-and-core-dumping.patch

   1 From 59ea6d06cfa9247b586a695c21f94afa7183af74 Mon Sep 17 00:00:00 2001
   2 From: Andrea Arcangeli <aarcange@redhat.com>
   3 Date: Thu, 13 Jun 2019 15:56:11 -0700
   4 Subject: coredump: fix race condition between collapse_huge_page() and core dumping
   5
   6 From: Andrea Arcangeli <aarcange@redhat.com>
   7
   8 commit 59ea6d06cfa9247b586a695c21f94afa7183af74 upstream.
   9
  10 When fixing the race conditions between the coredump and the mmap_sem
  11 holders outside the context of the process, we focused on
  12 mmget_not_zero()/get_task_mm() callers in 04f5866e41fb70 ("coredump: fix
  13 race condition between mmget_not_zero()/get_task_mm() and core
  14 dumping"), but those aren't the only cases where the mmap_sem can be
  15 taken outside of the context of the process as Michal Hocko noticed
  16 while backporting that commit to older -stable kernels.
  17
  18 If mmgrab() is called in the context of the process, but then the
  19 mm_count reference is transferred outside the context of the process,
  20 that can also be a problem if the mmap_sem has to be taken for writing
  21 through that mm_count reference.
  22
  23 khugepaged registration calls mmgrab() in the context of the process,
  24 but the mmap_sem for writing is taken later in the context of the
  25 khugepaged kernel thread.
  26
  27 collapse_huge_page() after taking the mmap_sem for writing doesn't
  28 modify any vma, so it's not obvious that it could cause a problem to the
  29 coredump, but it happens to modify the pmd in a way that breaks an
  30 invariant that pmd_trans_huge_lock() relies upon.  collapse_huge_page()
  31 needs the mmap_sem for writing just to block concurrent page faults that
  32 call pmd_trans_huge_lock().
  33
  34 Specifically the invariant that "!pmd_trans_huge()" cannot become a
  35 "pmd_trans_huge()" doesn't hold while collapse_huge_page() runs.
  36
  37 The coredump will call __get_user_pages() without mmap_sem for reading,
  38 which eventually can invoke a lockless page fault which will need a
  39 functional pmd_trans_huge_lock().
  40
  41 So collapse_huge_page() needs to use mmget_still_valid() to check it's
  42 not running concurrently with the coredump...  as long as the coredump
  43 can invoke page faults without holding the mmap_sem for reading.
  44
  45 This has "Fixes: khugepaged" to facilitate backporting, but in my view
  46 it's more a bug in the coredump code that will eventually have to be
  47 rewritten to stop invoking page faults without the mmap_sem for reading.
  48 So the long term plan is still to drop all mmget_still_valid().
  49
  50 Link: http://lkml.kernel.org/r/20190607161558.32104-1-aarcange@redhat.com
  51 Fixes: ba76149f47d8 ("thp: khugepaged")
  52 Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
  53 Reported-by: Michal Hocko <mhocko@suse.com>
  54 Acked-by: Michal Hocko <mhocko@suse.com>
  55 Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
  56 Cc: Oleg Nesterov <oleg@redhat.com>
  57 Cc: Jann Horn <jannh@google.com>
  58 Cc: Hugh Dickins <hughd@google.com>
  59 Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
  60 Cc: Mike Kravetz <mike.kravetz@oracle.com>
  61 Cc: Peter Xu <peterx@redhat.com>
  62 Cc: Jason Gunthorpe <jgg@mellanox.com>
  63 Cc: <stable@vger.kernel.org>
  64 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  65 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  66 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  67
  68 ---
  69  include/linux/sched/mm.h |    4 ++++
  70  mm/khugepaged.c          |    3 +++
  71  2 files changed, 7 insertions(+)
  72
  73 --- a/include/linux/sched/mm.h
  74 +++ b/include/linux/sched/mm.h
  75 @@ -54,6 +54,10 @@ static inline void mmdrop(struct mm_stru
  76   * followed by taking the mmap_sem for writing before modifying the
  77   * vmas or anything the coredump pretends not to change from under it.
  78   *
  79 + * It also has to be called when mmgrab() is used in the context of
  80 + * the process, but then the mm_count refcount is transferred outside
  81 + * the context of the process to run down_write() on that pinned mm.
  82 + *
  83   * NOTE: find_extend_vma() called from GUP context is the only place
  84   * that can modify the "mm" (notably the vm_start/end) under mmap_sem
  85   * for reading and outside the context of the process, so it is also
  86 --- a/mm/khugepaged.c
  87 +++ b/mm/khugepaged.c
  88 @@ -1004,6 +1004,9 @@ static void collapse_huge_page(struct mm
  89          * handled by the anon_vma lock + PG_lock.
  90          */
  91         down_write(&mm->mmap_sem);
  92 +       result = SCAN_ANY_PROCESS;
  93 +       if (!mmget_still_valid(mm))
  94 +               goto out;
  95         result = hugepage_vma_revalidate(mm, address, &vma);
  96         if (result)
  97                 goto out;