[PATCH v3 hmm 00/12] mm/hmm: Various revisions from a locking/code review
jgg at ziepe.ca
Fri Jun 14 00:44:38 UTC 2019
From: Jason Gunthorpe <jgg at mellanox.com>
This patch series arised out of discussions with Jerome when looking at the
ODP changes, particularly informed by use after free races we have already
found and fixed in the ODP code (thanks to syzkaller) working with mmu
notifiers, and the discussion with Ralph on how to resolve the lifetime model.
Overall this brings in a simplified locking scheme and easy to explain
If a hmm_range is valid, then the hmm is valid, if a hmm is valid then the mm
is allocated memory.
If the mm needs to still be alive (ie to lock the mmap_sem, find a vma, etc)
then the mmget must be obtained via mmget_not_zero().
The use unlocked reads on 'hmm->dead' are also eliminated in favour of using
standard mmget() locking to prevent the mm from being released. Many of the
debugging checks of !range->hmm and !hmm->mm are dropped in favour of poison -
which is much clearer as to the lifetime intent.
The trailing patches are just some random cleanups I noticed when reviewing
I would like to run some testing with the ODP patch, but haven't
yet. Otherwise I think this is reviewed enough, and if there is nothing more
say I hope to apply it next week.
I plan to continue to work on the idea with CH to move more of this mirror
code into mmu notifiers and other places, but this will take some time and
Thanks to everyone who took time to look at this!
Jason Gunthorpe (12):
mm/hmm: fix use after free with struct hmm in the mmu notifiers
mm/hmm: Use hmm_mirror not mm as an argument for hmm_range_register
mm/hmm: Hold a mmgrab from hmm to mm
mm/hmm: Simplify hmm_get_or_create and make it reliable
mm/hmm: Remove duplicate condition test before wait_event_timeout
mm/hmm: Hold on to the mmget for the lifetime of the range
mm/hmm: Use lockdep instead of comments
mm/hmm: Remove racy protection against double-unregistration
mm/hmm: Poison hmm_range during unregister
mm/hmm: Do not use list*_rcu() for hmm->ranges
mm/hmm: Remove confusing comment and logic from hmm_release
mm/hmm: Fix error flows in hmm_invalidate_range_start
drivers/gpu/drm/nouveau/nouveau_svm.c | 2 +-
include/linux/hmm.h | 52 +----
kernel/fork.c | 1 -
mm/hmm.c | 286 ++++++++++++--------------
4 files changed, 140 insertions(+), 201 deletions(-)
More information about the amd-gfx