Re: on CONFIG_MM_OWNER=y, kernel panic is possible.

[Balbir Singh <balbir@linux.vnet.ibm.com>]

KOSAKI Motohiro wrote:
>> That is not possible. If you look at where mm_update_next_owner() is called
>> from, we call it from
>>
>> exit_mm() and exec_mmap()
>>
>> In both cases, we ensure that the task's mm has changed (to NULL and the new mm
>> respectively), before we call mm_update_next_owner(), hence c->mm can never be
>> equal to p->mm.
> 
> if so, following patch is needed instead.
> 
> 
> 
> ---
>  fs/exec.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: b/fs/exec.c
> ===================================================================
> --- a/fs/exec.c 2008-05-04 22:57:09.000000000 +0900
> +++ b/fs/exec.c 2008-05-06 15:40:35.000000000 +0900
> @@ -735,7 +735,7 @@ static int exec_mmap(struct mm_struct *m
>         tsk->active_mm = mm;
>         activate_mm(active_mm, mm);
>         task_unlock(tsk);
> -       mm_update_next_owner(mm);
> +       mm_update_next_owner(old_mm);
>         arch_pick_mmap_layout(mm);
>         if (old_mm) {
>                 up_read(&old_mm->mmap_sem);
> 
> 

Yes, good catch.

Acked-by: Balbir Singh <balbir@linux.vnet.ibm.com>

I'll go ahead and do some more testing on top of it. CC'ing Paul Menage as well.

-- 
	Warm Regards,
	Balbir Singh
	Linux Technology Center
	IBM, ISTL