Andrea Arcangeli 59ea6d06cf coredump: fix race condition between collapse_huge_page() and core dumping ... When fixing the race conditions between the coredump and the mmap_sem holders outside the context of the process, we focused on mmget_not_zero()/get_task_mm() callers in 04f5866e41 ("coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping"), but those aren't the only cases where the mmap_sem can be taken outside of the context of the process as Michal Hocko noticed while backporting that commit to older -stable kernels. If mmgrab() is called in the context of the process, but then the mm_count reference is transferred outside the context of the process, that can also be a problem if the mmap_sem has to be taken for writing through that mm_count reference. khugepaged registration calls mmgrab() in the context of the process, but the mmap_sem for writing is taken later in the context of the khugepaged kernel thread. collapse_huge_page() after taking the mmap_sem for writing doesn't modify any vma, so it's not obvious that it could cause a problem to the coredump, but it happens to modify the pmd in a way that breaks an invariant that pmd_trans_huge_lock() relies upon. collapse_huge_page() needs the mmap_sem for writing just to block concurrent page faults that call pmd_trans_huge_lock(). Specifically the invariant that "!pmd_trans_huge()" cannot become a "pmd_trans_huge()" doesn't hold while collapse_huge_page() runs. The coredump will call __get_user_pages() without mmap_sem for reading, which eventually can invoke a lockless page fault which will need a functional pmd_trans_huge_lock(). So collapse_huge_page() needs to use mmget_still_valid() to check it's not running concurrently with the coredump... as long as the coredump can invoke page faults without holding the mmap_sem for reading. This has "Fixes: khugepaged" to facilitate backporting, but in my view it's more a bug in the coredump code that will eventually have to be rewritten to stop invoking page faults without the mmap_sem for reading. So the long term plan is still to drop all mmget_still_valid(). Link: http://lkml.kernel.org/r/20190607161558.32104-1-aarcange@redhat.com Fixes: ba76149f47 ("thp: khugepaged") Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> Reported-by: Michal Hocko <mhocko@suse.com> Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Jann Horn <jannh@google.com> Cc: Hugh Dickins <hughd@google.com> Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Peter Xu <peterx@redhat.com> Cc: Jason Gunthorpe <jgg@mellanox.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2019-06-13 17:34:56 -10:00
..
autogroup.h
clock.h
coredump.h	oom, oom_reaper: do not enqueue same task twice	2019-02-01 15:46:23 -08:00
cpufreq.h	sched/cpufreq: Prepare schedutil for Energy Aware Scheduling	2018-12-11 15:16:58 +01:00
cputime.h
deadline.h
debug.h
hotplug.h
idle.h
init.h
isolation.h	sched: Fix various typos in comments	2018-12-03 11:55:42 +01:00
jobctl.h	cgroup: cgroup v2 freezer	2019-04-19 11:26:48 -07:00
loadavg.h	sched: loadavg: make calc_load_n() public	2018-10-26 16:26:32 -07:00
mm.h	coredump: fix race condition between collapse_huge_page() and core dumping	2019-06-13 17:34:56 -10:00
nohz.h
numa_balancing.h
prio.h
rt.h
signal.h	include/linux/sched/signal.h: replace tsk' with task'	2019-05-14 19:52:52 -07:00
smt.h	x86/speculation: Rework SMT state change	2018-11-28 11:57:07 +01:00
stat.h	sched: Fix various typos in comments	2018-12-03 11:55:42 +01:00
sysctl.h	sched/topology: Introduce a sysctl for Energy Aware Scheduling	2019-01-27 12:29:37 +01:00
task_stack.h	sched/core: Convert task_struct.stack_refcount to refcount_t	2019-02-04 08:53:56 +01:00
task.h	fork: Provide a function for copying init_mm	2019-04-30 12:37:51 +02:00
topology.h	sched_domain: Annotate RCU pointers properly	2019-04-03 12:34:31 +02:00
user.h	keys: safe concurrent user->{session,uid}_keyring access	2019-04-10 10:29:50 -07:00
wake_q.h	sched/wake_q: Reduce reference counting for special users	2019-02-04 09:03:28 +01:00
xacct.h