Re: [PATCH 6.1.y] fork: defer linking file vma until vma is fully initialized

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Apr 26, 2024 at 04:51:33PM +0800, Miaohe Lin wrote:
> Thorvald reported a WARNING [1]. And the root cause is below race:
> 
>  CPU 1					CPU 2
>  fork					hugetlbfs_fallocate
>   dup_mmap				 hugetlbfs_punch_hole
>    i_mmap_lock_write(mapping);
>    vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.
>    i_mmap_unlock_write(mapping);
>    hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!
> 					 i_mmap_lock_write(mapping);
>    					 hugetlb_vmdelete_list
> 					  vma_interval_tree_foreach
> 					   hugetlb_vma_trylock_write -- Vma_lock is cleared.
>    tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem!
> 					   hugetlb_vma_unlock_write -- Vma_lock is assigned!!!
> 					 i_mmap_unlock_write(mapping);
> 
> hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside
> i_mmap_rwsem lock while vma lock can be used in the same time.  Fix this
> by deferring linking file vma until vma is fully initialized.  Those vmas
> should be initialized first before they can be used.
> 
> Link: https://lkml.kernel.org/r/20240410091441.3539905-1-linmiaohe@huawei.com
> Fixes: 8d9bfb260814 ("hugetlb: add vma based lock for pmd sharing")
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> Reported-by: Thorvald Natvig <thorvald@google.com>
> Closes: https://lore.kernel.org/linux-mm/20240129161735.6gmjsswx62o4pbja@revolver/T/ [1]
> Reviewed-by: Jane Chu <jane.chu@oracle.com>
> Cc: Christian Brauner <brauner@kernel.org>
> Cc: Heiko Carstens <hca@linux.ibm.com>
> Cc: Kent Overstreet <kent.overstreet@linux.dev>
> Cc: Liam R. Howlett <Liam.Howlett@oracle.com>
> Cc: Mateusz Guzik <mjguzik@gmail.com>
> Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
> Cc: Miaohe Lin <linmiaohe@huawei.com>
> Cc: Muchun Song <muchun.song@linux.dev>
> Cc: Oleg Nesterov <oleg@redhat.com>
> Cc: Peng Zhang <zhangpeng.00@bytedance.com>
> Cc: Tycho Andersen <tandersen@netflix.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit 35e351780fa9d8240dd6f7e4f245f9ea37e96c19)
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> ---
>  kernel/fork.c | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)

Both now queued up, thanks.

greg k-h