From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754607AbcJUGqH (ORCPT <rfc822;w@1wt.eu>);
        Fri, 21 Oct 2016 02:46:07 -0400
Received: from mail-lf0-f67.google.com ([209.85.215.67]:33145 "EHLO
        mail-lf0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1754086AbcJUGqF (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 21 Oct 2016 02:46:05 -0400
Date: Fri, 21 Oct 2016 08:46:02 +0200
From: Michal Hocko <mhocko@kernel.org>
To: Brian Norris <briannorris@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
        Andy Lutomirski <luto@kernel.org>,
        Phil not Paul Oester <kernel@linuxace.com>,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        Willy Tarreau <w@1wt.eu>, Guenter Roeck <linux@roeck-us.net>,
        Kees Cook <keescook@chromium.org>,
        Dmitry Torokhov <dmitry.torokhov@gmail.com>
Subject: Re: [3.8 Regression] backporting "[PATCH stable pre 3.9] mm, gup:
 close FOLL MAP_PRIVATE race"
Message-ID: <20161021064602.GD6045@dhcp22.suse.cz>
References: <20161021063938.GA5463@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20161021063938.GA5463@google.com>
User-Agent: Mutt/1.6.0 (2016-04-01)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu 20-10-16 23:39:39, Brian Norris wrote:
> (Preface: this wasn't a clean backport, I'm a bit under the weather, and
> it's getting late here. So forgive me if my head's not on straight.)
> 
> Hi,
> 
> I'm not sure the best way to report this, but the Chrome OS test
> infrastructure noticed some problems when testing the following patch
> backported to our 3.8 kernels:
> 
> http://www.spinics.net/lists/stable/msg147998.html
> 
> Specifically (if you can hold your nose and stand Gerrit), this change:
> 
> https://chromium-review.googlesource.com/#/c/401041/

This is not correct. You have
https://chromium-review.googlesource.com/#/c/401041/2/mm/memory.c

f ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, page, flags)) {
		pte_unmap_unlock(ptep, ptl);
		goto no_page;
	}

so you do a double unlock. See how my patch does
+	if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, page, flags)) {
+		pte_unmap_unlock(ptep, ptl);
+		return NULL;
+	}

-- 
Michal Hocko
SUSE Labs