From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1764780AbYA2QHw (ORCPT ); Tue, 29 Jan 2008 11:07:52 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1757076AbYA2QHm (ORCPT ); Tue, 29 Jan 2008 11:07:42 -0500 Received: from relay1.sgi.com ([192.48.171.29]:51045 "EHLO relay.sgi.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756617AbYA2QHl (ORCPT ); Tue, 29 Jan 2008 11:07:41 -0500 Date: Tue, 29 Jan 2008 10:07:37 -0600 From: Robin Holt To: Christoph Lameter Cc: Andrea Arcangeli , Robin Holt , Avi Kivity , Izik Eidus , Nick Piggin , kvm-devel@lists.sourceforge.net, Benjamin Herrenschmidt , Peter Zijlstra , steiner@sgi.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, daniel.blueman@quadrics.com, Hugh Dickins Subject: Re: [patch 1/6] mmu_notifier: Core code Message-ID: <20080129160737.GV3058@sgi.com> References: <20080128202840.974253868@sgi.com> <20080128202923.609249585@sgi.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080128202923.609249585@sgi.com> User-Agent: Mutt/1.5.15+20070412 (2007-04-11) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I am going to seperate my comments into individual replies to help reduce the chance they are lost. > +void mmu_notifier_release(struct mm_struct *mm) ... > + hlist_for_each_entry_safe_rcu(mn, n, t, > + &mm->mmu_notifier.head, hlist) { > + if (mn->ops->release) > + mn->ops->release(mn, mm); > + hlist_del(&mn->hlist); This is a use-after-free issue. The hlist_del_rcu needs to be done before the callout as the structure containing the mmu_notifier structure will need to be freed from within the ->release callout. Thanks, Robin From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robin Holt Subject: Re: [patch 1/6] mmu_notifier: Core code Date: Tue, 29 Jan 2008 10:07:37 -0600 Message-ID: <20080129160737.GV3058@sgi.com> References: <20080128202840.974253868@sgi.com> <20080128202923.609249585@sgi.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Nick Piggin , Andrea Arcangeli , Peter Zijlstra , linux-mm-Bw31MaZKKs3YtjvyW6yDsg@public.gmane.org, Benjamin Herrenschmidt , steiner-sJ/iWh9BUns@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Avi Kivity , kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, daniel.blueman-xqY44rlHlBpWk0Htik3J/w@public.gmane.org, Robin Holt , Hugh Dickins To: Christoph Lameter Return-path: Content-Disposition: inline In-Reply-To: <20080128202923.609249585-sJ/iWh9BUns@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org I am going to seperate my comments into individual replies to help reduce the chance they are lost. > +void mmu_notifier_release(struct mm_struct *mm) ... > + hlist_for_each_entry_safe_rcu(mn, n, t, > + &mm->mmu_notifier.head, hlist) { > + if (mn->ops->release) > + mn->ops->release(mn, mm); > + hlist_del(&mn->hlist); This is a use-after-free issue. The hlist_del_rcu needs to be done before the callout as the structure containing the mmu_notifier structure will need to be freed from within the ->release callout. Thanks, Robin ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Tue, 29 Jan 2008 10:07:37 -0600 From: Robin Holt Subject: Re: [patch 1/6] mmu_notifier: Core code Message-ID: <20080129160737.GV3058@sgi.com> References: <20080128202840.974253868@sgi.com> <20080128202923.609249585@sgi.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080128202923.609249585@sgi.com> Sender: owner-linux-mm@kvack.org Return-Path: To: Christoph Lameter Cc: Andrea Arcangeli , Robin Holt , Avi Kivity , Izik Eidus , Nick Piggin , kvm-devel@lists.sourceforge.net, Benjamin Herrenschmidt , Peter Zijlstra , steiner@sgi.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, daniel.blueman@quadrics.com, Hugh Dickins List-ID: I am going to seperate my comments into individual replies to help reduce the chance they are lost. > +void mmu_notifier_release(struct mm_struct *mm) ... > + hlist_for_each_entry_safe_rcu(mn, n, t, > + &mm->mmu_notifier.head, hlist) { > + if (mn->ops->release) > + mn->ops->release(mn, mm); > + hlist_del(&mn->hlist); This is a use-after-free issue. The hlist_del_rcu needs to be done before the callout as the structure containing the mmu_notifier structure will need to be freed from within the ->release callout. Thanks, Robin -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org