Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 90ed52eb authored by Hugh Dickins's avatar Hugh Dickins Committed by Linus Torvalds
Browse files

[PATCH] holepunch: fix mmap_sem i_mutex deadlock 



sys_madvise has down_write of mmap_sem, then madvise_remove calls
vmtruncate_range which takes i_mutex and i_alloc_sem: no, we can easily devise
deadlocks from that ordering.

madvise_remove drop mmap_sem while calling vmtruncate_range: luckily, since
madvise_remove doesn't split or merge vmas, it's easy to handle this case with
a NULL prev, without restructuring sys_madvise.  (Though sad to retake
mmap_sem when it's unlikely to be needed, and certainly down_read is
sufficient for MADV_REMOVE, unlike the other madvices.)

Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
Cc: Miklos Szeredi <mszeredi@suse.cz>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Cc: Nick Piggin <npiggin@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 16a10019

mm/madvise.c

+14 −5
Original line number Diff line number Diff line
@@ -160,8 +160,9 @@ static long madvise_remove(struct vm_area_struct *vma, 
{

	struct address_space *mapping;

	loff_t offset, endoff;

	int error;



	*prev = vma;

	*prev = NULL;	/* tell sys_madvise we drop mmap_sem */



	if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))

		return -EINVAL;
@@ -180,7 +181,12 @@ static long madvise_remove(struct vm_area_struct *vma, 
			+ ((loff_t)vma->vm_pgoff << PAGE_SHIFT);

	endoff = (loff_t)(end - vma->vm_start - 1)

			+ ((loff_t)vma->vm_pgoff << PAGE_SHIFT);

	return  vmtruncate_range(mapping->host, offset, endoff);



	/* vmtruncate_range needs to take i_mutex and i_alloc_sem */

	up_write(&current->mm->mmap_sem);

	error = vmtruncate_range(mapping->host, offset, endoff);

	down_write(&current->mm->mmap_sem);

	return error;

}



static long
@@ -315,12 +321,15 @@ asmlinkage long sys_madvise(unsigned long start, size_t len_in, int behavior) 
		if (error)

			goto out;

		start = tmp;

		if (start < prev->vm_end)

		if (prev && start < prev->vm_end)

			start = prev->vm_end;

		error = unmapped_error;

		if (start >= end)

			goto out;

		if (prev)

			vma = prev->vm_next;

		else	/* madvise_remove dropped mmap_sem */

			vma = find_vma(current->mm, start);

	}

out:

	up_write(&current->mm->mmap_sem);