Skip to contentSkip to conversation

Patch "userfaultfd: non-cooperative: notify about unmap of destination during mremap" has been added to the 4.12-stable tree

PATCH [email protected] 1 participant 1 message Aug 7, 2017

Subsystems (3)
Stable branch Memory management Memory mapping
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

userfaultfd: non-cooperative: notify about unmap of destination during mremap

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
userfaultfd-non-cooperative-notify-about-unmap-of-destination-during-mremap.patch
and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From b22823719302e88d0e2a6bb06433bd97b175a8d8 Mon Sep 17 00:00:00 2001

From: Mike Rapoport <[email protected]>
Date: Wed, 2 Aug 2017 13:31:55 -0700
Subject: userfaultfd: non-cooperative: notify about unmap of destination during mremap

From: Mike Rapoport <[email protected]>

commit b22823719302e88d0e2a6bb06433bd97b175a8d8 upstream.

When mremap is called with MREMAP_FIXED it unmaps memory at the destination address without notifying userfaultfd monitor.

If the destination were registered with userfaultfd, the monitor has no way to distinguish between the old and new ranges and to properly relate the page faults that would occur in the destination region.

Fixes 897ab3e0c49e ("userfaultfd: non-cooperative: add event for memory unmaps")
Link http://lkml.kernel.org/r/[email protected] open here
Signed-off-by Mike Rapoport <[email protected]>
Acked-by Pavel Emelyanov <[email protected]>
Cc Andrea Arcangeli <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
Signed-off-by Linus Torvalds <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 mm/mremap.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
mm/mremap.c +5 -2
@@ -429,6 +429,7 @@ static struct vm_area_struct *vma_to_res
 static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
 		unsigned long new_addr, unsigned long new_len, bool *locked,
 		struct vm_userfaultfd_ctx *uf,
+		struct list_head *uf_unmap_early,
 		struct list_head *uf_unmap)
 {
 	struct mm_struct *mm = current->mm;

@@ -447,7 +448,7 @@ static unsigned long mremap_to(unsigned
 	if (addr + old_len > new_addr && new_addr + new_len > addr)
 		goto out;
 
-	ret = do_munmap(mm, new_addr, new_len, NULL);
+	ret = do_munmap(mm, new_addr, new_len, uf_unmap_early);
 	if (ret)
 		goto out;
 

@@ -515,6 +516,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, a
 	unsigned long charged = 0;
 	bool locked = false;
 	struct vm_userfaultfd_ctx uf = NULL_VM_UFFD_CTX;
+	LIST_HEAD(uf_unmap_early);
 	LIST_HEAD(uf_unmap);
 
 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))

@@ -542,7 +544,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, a
 
 	if (flags & MREMAP_FIXED) {
 		ret = mremap_to(addr, old_len, new_addr, new_len,
-				&locked, &uf, &uf_unmap);
+				&locked, &uf, &uf_unmap_early, &uf_unmap);
 		goto out;
 	}
 

@@ -622,6 +624,7 @@ out:
 	up_write(&current->mm->mmap_sem);
 	if (locked && new_len > old_len)
 		mm_populate(new_addr + old_len, new_len - old_len);
+	userfaultfd_unmap_complete(mm, &uf_unmap_early);
 	mremap_userfaultfd_complete(&uf, addr, new_addr, old_len);
 	userfaultfd_unmap_complete(mm, &uf_unmap);
 	return ret;

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/userfaultfd-non-cooperative-flush-event_wqh-at-release-time.patch queue-4.12/userfaultfd_zeropage-return-enospc-in-case-mm-has-gone.patch queue-4.12/userfaultfd-non-cooperative-notify-about-unmap-of-destination-during-mremap.patch