iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RDMA/odp: Ensure the mm is still alive before creating an implicit child

Browse Source 
Registration of a mmu_notifier requires the caller to hold a mmget() on
the mm as registration is not permitted to race with exit_mmap(). There is
a BUG_ON inside the mmu_notifier to guard against this.

Normally creating a umem is done against current which implicitly holds
the mmget(), however an implicit ODP child is created from a pagefault
work queue and is not guaranteed to have a mmget().

Call mmget() around this registration and abort faulting if the MM has
gone to exit_mmap().

Before the patch below the notifier was registered when the implicit ODP
parent was created, so there was no chance to register a notifier outside
of current.

Fixes: c571feca2dc9 ("RDMA/odp: use mmu_notifier_get/put for 'struct ib_ucontext_per_mm'")
Link: https://lore.kernel.org/r/20200227114118.94736-1-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Jason Gunthorpe 2020-02-27 13:41:18 +02:00
parent e38b55ea04
commit a4e63bce14
1 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/infiniband/core/umem_odp.c
View File

@ -181,14 +181,28 @@ ib_umem_odp_alloc_child(struct ib_umem_odp *root, unsigned long addr,
odp_data->page_shift = PAGE_SHIFT; odp_data->page_shift = PAGE_SHIFT;
odp_data->notifier.ops = ops; odp_data->notifier.ops = ops;
/*
* A mmget must be held when registering a notifier, the owming_mm only
* has a mm_grab at this point.
*/
if (!mmget_not_zero(umem->owning_mm)) {
ret = -EFAULT;
goto out_free;
}
odp_data->tgid = get_pid(root->tgid); odp_data->tgid = get_pid(root->tgid);
ret = ib_init_umem_odp(odp_data, ops); ret = ib_init_umem_odp(odp_data, ops);
if (ret) { if (ret)
put_pid(odp_data->tgid); goto out_tgid;
kfree(odp_data); mmput(umem->owning_mm);
return ERR_PTR(ret);
}
return odp_data; return odp_data;
out_tgid:
put_pid(odp_data->tgid);
mmput(umem->owning_mm);
out_free:
kfree(odp_data);
return ERR_PTR(ret);
} }
EXPORT_SYMBOL(ib_umem_odp_alloc_child); EXPORT_SYMBOL(ib_umem_odp_alloc_child);