From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Hellwig Subject: [PATCH 06/22] mm/hmm: fix use after free with struct hmm in the mmu notifiers Date: Mon, 1 Jul 2019 08:20:04 +0200 Message-ID: <20190701062020.19239-7-hch@lst.de> References: <20190701062020.19239-1-hch@lst.de> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20190701062020.19239-1-hch-jcswGhMUV9g@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: nouveau-bounces-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Sender: "Nouveau" To: Dan Williams , =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= , Jason Gunthorpe , Ben Skeggs Cc: Philip Yang , Ralph Campbell , linux-nvdimm-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org, linux-pci-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, dri-devel-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org, linux-mm-Bw31MaZKKs3YtjvyW6yDsg@public.gmane.org, nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org, Ira Weiny List-Id: dri-devel@lists.freedesktop.org RnJvbTogSmFzb24gR3VudGhvcnBlIDxqZ2dAbWVsbGFub3guY29tPgoKbW11X25vdGlmaWVyX3Vu cmVnaXN0ZXJfbm9fcmVsZWFzZSgpIGlzIG5vdCBhIGZlbmNlIGFuZCB0aGUgbW11X25vdGlmaWVy CnN5c3RlbSB3aWxsIGNvbnRpbnVlIHRvIHJlZmVyZW5jZSBobW0tPm1uIHVudGlsIHRoZSBzcmN1 IGdyYWNlIHBlcmlvZApleHBpcmVzLgoKUmVzdWx0aW5nIGluIHVzZSBhZnRlciBmcmVlIHJhY2Vz IGxpa2UgdGhpczoKCiAgICAgICAgIENQVTAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgQ1BVMQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IF9fbW11X25vdGlmaWVyX2ludmFsaWRhdGVfcmFuZ2Vfc3RhcnQoKQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3JjdV9yZWFkX2xvY2sKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhsaXN0X2Zvcl9lYWNoICgp CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8vIG1u ID09IGhtbS0+bW4KaG1tX21pcnJvcl91bnJlZ2lzdGVyKCkKICBobW1fcHV0KCkKICAgIGhtbV9m cmVlKCkKICAgICAgbW11X25vdGlmaWVyX3VucmVnaXN0ZXJfbm9fcmVsZWFzZSgpCiAgICAgICAg IGhsaXN0X2RlbF9pbml0X3JjdShobW0tbW4tPmxpc3QpCgkJCSAgICAgICAgICAgICAgICAgICAg ICAgICAgIG1uLT5vcHMtPmludmFsaWRhdGVfcmFuZ2Vfc3RhcnQobW4sIHJhbmdlKTsKCQkJCQkg ICAgICAgICAgICAgbW1fZ2V0X2htbSgpCiAgICAgIG1tLT5obW0gPSBOVUxMOwogICAgICBrZnJl ZShobW0pCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgbXV0ZXhfbG9jaygmaG1tLT5sb2NrKTsKClVzZSBTUkNVIHRvIGtmcmVlIHRoZSBobW0gbWVt b3J5IHNvIHRoYXQgdGhlIG5vdGlmaWVycyBjYW4gcmVseSBvbiBobW0KZXhpc3RpbmcuIEdldCB0 aGUgbm93LXNhZmUgaG1tIHN0cnVjdCB0aHJvdWdoIGNvbnRhaW5lcl9vZiBhbmQgZGlyZWN0bHkK Y2hlY2sga3JlZl9nZXRfdW5sZXNzX3plcm8gdG8gbG9jayBpdCBhZ2FpbnN0IGZyZWUuCgpTaWdu ZWQtb2ZmLWJ5OiBKYXNvbiBHdW50aG9ycGUgPGpnZ0BtZWxsYW5veC5jb20+ClJldmlld2VkLWJ5 OiBJcmEgV2VpbnkgPGlyYS53ZWlueUBpbnRlbC5jb20+ClJldmlld2VkLWJ5OiBKb2huIEh1YmJh cmQgPGpodWJiYXJkQG52aWRpYS5jb20+ClJldmlld2VkLWJ5OiBSYWxwaCBDYW1wYmVsbCA8cmNh bXBiZWxsQG52aWRpYS5jb20+ClJldmlld2VkLWJ5OiBDaHJpc3RvcGggSGVsbHdpZyA8aGNoQGxz dC5kZT4KVGVzdGVkLWJ5OiBQaGlsaXAgWWFuZyA8UGhpbGlwLllhbmdAYW1kLmNvbT4KLS0tCiBp bmNsdWRlL2xpbnV4L2htbS5oIHwgIDEgKwogbW0vaG1tLmMgICAgICAgICAgICB8IDIzICsrKysr KysrKysrKysrKysrLS0tLS0tCiAyIGZpbGVzIGNoYW5nZWQsIDE4IGluc2VydGlvbnMoKyksIDYg ZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvaW5jbHVkZS9saW51eC9obW0uaCBiL2luY2x1ZGUv bGludXgvaG1tLmgKaW5kZXggNzAwNzEyMzg0MmJhLi5jYjAxY2YxZmEzYzAgMTAwNjQ0Ci0tLSBh L2luY2x1ZGUvbGludXgvaG1tLmgKKysrIGIvaW5jbHVkZS9saW51eC9obW0uaApAQCAtOTMsNiAr OTMsNyBAQCBzdHJ1Y3QgaG1tIHsKIAlzdHJ1Y3QgbW11X25vdGlmaWVyCW1tdV9ub3RpZmllcjsK IAlzdHJ1Y3Qgcndfc2VtYXBob3JlCW1pcnJvcnNfc2VtOwogCXdhaXRfcXVldWVfaGVhZF90CXdx OworCXN0cnVjdCByY3VfaGVhZAkJcmN1OwogCWxvbmcJCQlub3RpZmllcnM7CiAJYm9vbAkJCWRl YWQ7CiB9OwpkaWZmIC0tZ2l0IGEvbW0vaG1tLmMgYi9tbS9obW0uYwppbmRleCA4MjY4MTZhYjIz NzcuLmY2OTU2ZDc4ZTNjYiAxMDA2NDQKLS0tIGEvbW0vaG1tLmMKKysrIGIvbW0vaG1tLmMKQEAg LTEwNCw2ICsxMDQsMTEgQEAgc3RhdGljIHN0cnVjdCBobW0gKmhtbV9nZXRfb3JfY3JlYXRlKHN0 cnVjdCBtbV9zdHJ1Y3QgKm1tKQogCXJldHVybiBOVUxMOwogfQogCitzdGF0aWMgdm9pZCBobW1f ZnJlZV9yY3Uoc3RydWN0IHJjdV9oZWFkICpyY3UpCit7CisJa2ZyZWUoY29udGFpbmVyX29mKHJj dSwgc3RydWN0IGhtbSwgcmN1KSk7Cit9CisKIHN0YXRpYyB2b2lkIGhtbV9mcmVlKHN0cnVjdCBr cmVmICprcmVmKQogewogCXN0cnVjdCBobW0gKmhtbSA9IGNvbnRhaW5lcl9vZihrcmVmLCBzdHJ1 Y3QgaG1tLCBrcmVmKTsKQEAgLTExNiw3ICsxMjEsNyBAQCBzdGF0aWMgdm9pZCBobW1fZnJlZShz dHJ1Y3Qga3JlZiAqa3JlZikKIAkJbW0tPmhtbSA9IE5VTEw7CiAJc3Bpbl91bmxvY2soJm1tLT5w YWdlX3RhYmxlX2xvY2spOwogCi0Ja2ZyZWUoaG1tKTsKKwltbXVfbm90aWZpZXJfY2FsbF9zcmN1 KCZobW0tPnJjdSwgaG1tX2ZyZWVfcmN1KTsKIH0KIAogc3RhdGljIGlubGluZSB2b2lkIGhtbV9w dXQoc3RydWN0IGhtbSAqaG1tKQpAQCAtMTQ0LDEwICsxNDksMTQgQEAgdm9pZCBobW1fbW1fZGVz dHJveShzdHJ1Y3QgbW1fc3RydWN0ICptbSkKIAogc3RhdGljIHZvaWQgaG1tX3JlbGVhc2Uoc3Ry dWN0IG1tdV9ub3RpZmllciAqbW4sIHN0cnVjdCBtbV9zdHJ1Y3QgKm1tKQogewotCXN0cnVjdCBo bW0gKmhtbSA9IG1tX2dldF9obW0obW0pOworCXN0cnVjdCBobW0gKmhtbSA9IGNvbnRhaW5lcl9v Zihtbiwgc3RydWN0IGhtbSwgbW11X25vdGlmaWVyKTsKIAlzdHJ1Y3QgaG1tX21pcnJvciAqbWly cm9yOwogCXN0cnVjdCBobW1fcmFuZ2UgKnJhbmdlOwogCisJLyogQmFpbCBvdXQgaWYgaG1tIGlz IGluIHRoZSBwcm9jZXNzIG9mIGJlaW5nIGZyZWVkICovCisJaWYgKCFrcmVmX2dldF91bmxlc3Nf emVybygmaG1tLT5rcmVmKSkKKwkJcmV0dXJuOworCiAJLyogUmVwb3J0IHRoaXMgSE1NIGFzIGR5 aW5nLiAqLwogCWhtbS0+ZGVhZCA9IHRydWU7CiAKQEAgLTE4NSwxMyArMTk0LDE0IEBAIHN0YXRp YyB2b2lkIGhtbV9yZWxlYXNlKHN0cnVjdCBtbXVfbm90aWZpZXIgKm1uLCBzdHJ1Y3QgbW1fc3Ry dWN0ICptbSkKIHN0YXRpYyBpbnQgaG1tX2ludmFsaWRhdGVfcmFuZ2Vfc3RhcnQoc3RydWN0IG1t dV9ub3RpZmllciAqbW4sCiAJCQljb25zdCBzdHJ1Y3QgbW11X25vdGlmaWVyX3JhbmdlICpucmFu Z2UpCiB7Ci0Jc3RydWN0IGhtbSAqaG1tID0gbW1fZ2V0X2htbShucmFuZ2UtPm1tKTsKKwlzdHJ1 Y3QgaG1tICpobW0gPSBjb250YWluZXJfb2YobW4sIHN0cnVjdCBobW0sIG1tdV9ub3RpZmllcik7 CiAJc3RydWN0IGhtbV9taXJyb3IgKm1pcnJvcjsKIAlzdHJ1Y3QgaG1tX3VwZGF0ZSB1cGRhdGU7 CiAJc3RydWN0IGhtbV9yYW5nZSAqcmFuZ2U7CiAJaW50IHJldCA9IDA7CiAKLQlWTV9CVUdfT04o IWhtbSk7CisJaWYgKCFrcmVmX2dldF91bmxlc3NfemVybygmaG1tLT5rcmVmKSkKKwkJcmV0dXJu IDA7CiAKIAl1cGRhdGUuc3RhcnQgPSBucmFuZ2UtPnN0YXJ0OwogCXVwZGF0ZS5lbmQgPSBucmFu Z2UtPmVuZDsKQEAgLTIzNiw5ICsyNDYsMTAgQEAgc3RhdGljIGludCBobW1faW52YWxpZGF0ZV9y YW5nZV9zdGFydChzdHJ1Y3QgbW11X25vdGlmaWVyICptbiwKIHN0YXRpYyB2b2lkIGhtbV9pbnZh bGlkYXRlX3JhbmdlX2VuZChzdHJ1Y3QgbW11X25vdGlmaWVyICptbiwKIAkJCWNvbnN0IHN0cnVj dCBtbXVfbm90aWZpZXJfcmFuZ2UgKm5yYW5nZSkKIHsKLQlzdHJ1Y3QgaG1tICpobW0gPSBtbV9n ZXRfaG1tKG5yYW5nZS0+bW0pOworCXN0cnVjdCBobW0gKmhtbSA9IGNvbnRhaW5lcl9vZihtbiwg c3RydWN0IGhtbSwgbW11X25vdGlmaWVyKTsKIAotCVZNX0JVR19PTighaG1tKTsKKwlpZiAoIWty ZWZfZ2V0X3VubGVzc196ZXJvKCZobW0tPmtyZWYpKQorCQlyZXR1cm47CiAKIAltdXRleF9sb2Nr KCZobW0tPmxvY2spOwogCWhtbS0+bm90aWZpZXJzLS07Ci0tIAoyLjIwLjEKCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCk5vdXZlYXUgbWFpbGluZyBsaXN0 Ck5vdXZlYXVAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Au b3JnL21haWxtYW4vbGlzdGluZm8vbm91dmVhdQ==