linux-kernel - Re: [PATCH] [v4.14.y] infiniband: fix race condition between infiniband mlx4, mlx5 driver and core dumping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9C189085-083D-46EA-98DB-B11AD62051B6@vmware.com>
Date:   Fri, 14 Jun 2019 14:41:39 +0000
From:   Ajay Kaher <akaher@...are.com>
To:     "aarcange@...hat.com" <aarcange@...hat.com>,
        "jannh@...gle.com" <jannh@...gle.com>,
        "oleg@...hat.com" <oleg@...hat.com>,
        "peterx@...hat.com" <peterx@...hat.com>,
        "rppt@...ux.ibm.com" <rppt@...ux.ibm.com>,
        "jgg@...lanox.com" <jgg@...lanox.com>,
        "mhocko@...e.com" <mhocko@...e.com>
CC:     "yishaih@...lanox.com" <yishaih@...lanox.com>,
        "dledford@...hat.com" <dledford@...hat.com>,
        "sean.hefty@...el.com" <sean.hefty@...el.com>,
        "hal.rosenstock@...il.com" <hal.rosenstock@...il.com>,
        "matanb@...lanox.com" <matanb@...lanox.com>,
        "leonro@...lanox.com" <leonro@...lanox.com>,
        "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        Srivatsa Bhat <srivatsab@...are.com>,
        Alexey Makhalov <amakhalov@...are.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] [v4.14.y] infiniband: fix race condition between
 infiniband mlx4, mlx5  driver and core dumping


On 10/06/19, 6:22 PM, "Ajay Kaher" <akaher@...are.com> wrote:

> This patch is the extension of following upstream commit to fix
> the race condition between get_task_mm() and core dumping
> for IB->mlx4 and IB->mlx5 drivers:
> 
> commit 04f5866e41fb ("coredump: fix race condition between
> mmget_not_zero()/get_task_mm() and core dumping")'
>    
> Thanks to Jason for pointing this.
>    
> Signed-off-by: Ajay Kaher <akaher@...are.com>
> Acked-by: Jason Gunthorpe <jgg@...lanox.com>

Greg, I hope you would like to review and proceed further with this patch.  

> ---
> drivers/infiniband/hw/mlx4/main.c | 4 +++-
> drivers/infiniband/hw/mlx5/main.c | 3 +++
> 2 files changed, 6 insertions(+), 1 deletion(-)
>    
> diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
> index e2beb18..0299c06 100644
> --- a/drivers/infiniband/hw/mlx4/main.c
> +++ b/drivers/infiniband/hw/mlx4/main.c
> @@ -1197,6 +1197,8 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
>  	 * mlx4_ib_vma_close().
>  	 */
>  	down_write(&owning_mm->mmap_sem);
> +	if (!mmget_still_valid(owning_mm))
> +		goto skip_mm;
>  	for (i = 0; i < HW_BAR_COUNT; i++) {
>  		vma = context->hw_bar_info[i].vma;
>  		if (!vma)
>  @@ -1215,7 +1217,7 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
>  		/* context going to be destroyed, should not access ops any more */
>  		context->hw_bar_info[i].vma->vm_ops = NULL;
>  	}
> -
> +skip_mm:
> 	up_write(&owning_mm->mmap_sem);
>  	mmput(owning_mm);
> 	put_task_struct(owning_process);
> diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
> index 13a9206..3fbe396 100644
> --- a/drivers/infiniband/hw/mlx5/main.c
> +++ b/drivers/infiniband/hw/mlx5/main.c
> @@ -1646,6 +1646,8 @@ static void mlx5_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
>  	 * mlx5_ib_vma_close.
>  	 */
>  	down_write(&owning_mm->mmap_sem);
> +	if (!mmget_still_valid(owning_mm))
> +		goto skip_mm;
>  	mutex_lock(&context->vma_private_list_mutex);
>  	list_for_each_entry_safe(vma_private, n, &context->vma_private_list,
>  				 list) {
> @@ -1662,6 +1664,7 @@ static void mlx5_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
>  		kfree(vma_private);
>  	}
>  	mutex_unlock(&context->vma_private_list_mutex);
> +skip_mm:
>  	up_write(&owning_mm->mmap_sem);
>  	mmput(owning_mm);
>  	put_task_struct(owning_process);
> -- 
> 2.7.4