Re: [RFC c/r 4/4] c/r: prctl: Extend PR_SET_MM to set up more mm_struct entries

[KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>]

>>> +
>>> +       case PR_SET_MM_AUXV:
>>> +               if (arg4 > sizeof(mm->saved_auxv))
>>> +                       goto out;
>>> +               up_read(&mm->mmap_sem);
>>> +
>>> +               error = -EFAULT;
>>> +               if (!copy_from_user(mm->saved_auxv, (const void __user *)addr, arg4))
>>> +                       error = 0;
>>> +
>>> +               return error;
>>
>> Is the mmap_sem released here because of the copy_from_user()? Is it
>> still safe to write to saved_auxv?
>>
> 
> At moment I believe yes (if only I'm not missing something), we poke this
> vector at elf loading procedure, so it's up to user to sync access to "own"
> saved_auxv and write sane values inside.

Think prctl(PR_SET_MM_AUXV) vs prctl(PR_SET_MM_AUXV) race. That might make to write corrupted value.
syscall should be atomic from a point of userland view.