[PATCH] userfaultfd: non-cooperative: notify about unmap of destination during mremap

[PATCH] userfaultfd: non-cooperative: notify about unmap of destination during mremap

[Mike Rapoport]

When mremap is called with MREMAP_FIXED it unmaps memory at the destination
address without notifying userfaultfd monitor. If the destination were
registered with userfaultfd, the monitor has no way to distinguish between
the old and new ranges and to properly relate the page faults that would
occur in the destination region.

Cc: stable@vger.kernel.org
Fixes: 897ab3e0c49e ("userfaultfd: non-cooperative: add event for memory
unmaps")

Signed-off-by: Mike Rapoport <rppt@linux.vnet.ibm.com>
---
 mm/mremap.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index cd8a1b199ef9..eb36ef9410e4 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -446,9 +446,14 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
 	if (addr + old_len > new_addr && new_addr + new_len > addr)
 		goto out;
 
-	ret = do_munmap(mm, new_addr, new_len, NULL);
+	/*
+	 * We presume the uf_unmap list is empty by this point and it
+	 * will be cleared again in userfaultfd_unmap_complete.
+	 */
+	ret = do_munmap(mm, new_addr, new_len, uf_unmap);
 	if (ret)
 		goto out;
+	userfaultfd_unmap_complete(mm, uf_unmap);
 
 	if (old_len >= new_len) {
 		ret = do_munmap(mm, addr+new_len, old_len - new_len, uf_unmap);
-- 
2.7.4

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH] userfaultfd: non-cooperative: notify about unmap of destination during mremap

[Mike Rapoport]

On Mon, Jul 17, 2017 at 09:18:13AM +0300, Mike Rapoport wrote:
> When mremap is called with MREMAP_FIXED it unmaps memory at the destination
> address without notifying userfaultfd monitor. If the destination were
> registered with userfaultfd, the monitor has no way to distinguish between
> the old and new ranges and to properly relate the page faults that would
> occur in the destination region.
> 
> Cc: stable@vger.kernel.org
> Fixes: 897ab3e0c49e ("userfaultfd: non-cooperative: add event for memory
> unmaps")
> 
> Signed-off-by: Mike Rapoport <rppt@linux.vnet.ibm.com>
> ---

Please discard this patch. I completely missed that
userfaultfd_unmap_complete releases mmap_sem :(

>  mm/mremap.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/mremap.c b/mm/mremap.c
> index cd8a1b199ef9..eb36ef9410e4 100644
> --- a/mm/mremap.c
> +++ b/mm/mremap.c
> @@ -446,9 +446,14 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
>  	if (addr + old_len > new_addr && new_addr + new_len > addr)
>  		goto out;
> 
> -	ret = do_munmap(mm, new_addr, new_len, NULL);
> +	/*
> +	 * We presume the uf_unmap list is empty by this point and it
> +	 * will be cleared again in userfaultfd_unmap_complete.
> +	 */
> +	ret = do_munmap(mm, new_addr, new_len, uf_unmap);
>  	if (ret)
>  		goto out;
> +	userfaultfd_unmap_complete(mm, uf_unmap);
> 
>  	if (old_len >= new_len) {
>  		ret = do_munmap(mm, addr+new_len, old_len - new_len, uf_unmap);
> -- 
> 2.7.4
> 

-- 
Sincerely yours,
Mike.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>