• Andrea Arcangeli's avatar
    coredump: fix race condition between collapse_huge_page() and core dumping · dc30d2ce
    Andrea Arcangeli authored
    commit 59ea6d06cfa9247b586a695c21f94afa7183af74 upstream.
    
    When fixing the race conditions between the coredump and the mmap_sem
    holders outside the context of the process, we focused on
    mmget_not_zero()/get_task_mm() callers in 04f5866e41fb70 ("coredump: fix
    race condition between mmget_not_zero()/get_task_mm() and core
    dumping"), but those aren't the only cases where the mmap_sem can be
    taken outside of the context of the process as Michal Hocko noticed
    while backporting that commit to older -stable kernels.
    
    If mmgrab() is called in the context of the process, but then the
    mm_count reference is transferred outside the context of the process,
    that can also be a problem if the mmap_sem has to be taken for writing
    through that mm_count reference.
    
    khugepaged registration calls mmgrab() in the context of the process,
    but the mmap_sem for writing is taken later in the context of the
    khugepaged kernel thread.
    
    collapse_huge_page() after taking the mmap_sem for writing doesn't
    modify any vma, so it's not obvious that it could cause a problem to the
    coredump, but it happens to modify the pmd in a way that breaks an
    invariant that pmd_trans_huge_lock() relies upon.  collapse_huge_page()
    needs the mmap_sem for writing just to block concurrent page faults that
    call pmd_trans_huge_lock().
    
    Specifically the invariant that "!pmd_trans_huge()" cannot become a
    "pmd_trans_huge()" doesn't hold while collapse_huge_page() runs.
    
    The coredump will call __get_user_pages() without mmap_sem for reading,
    which eventually can invoke a lockless page fault which will need a
    functional pmd_trans_huge_lock().
    
    So collapse_huge_page() needs to use mmget_still_valid() to check it's
    not running concurrently with the coredump...  as long as the coredump
    can invoke page faults without holding the mmap_sem for reading.
    
    This has "Fixes: khugepaged" to facilitate backporting, but in my view
    it's more a bug in the coredump code that will eventually have to be
    rewritten to stop invoking page faults without the mmap_sem for reading.
    So the long term plan is still to drop all mmget_still_valid().
    
    Link: http://lkml.kernel.org/r/20190607161558.32104-1-aarcange@redhat.com
    Fixes: ba76149f ("thp: khugepaged")
    Signed-off-by: 's avatarAndrea Arcangeli <aarcange@redhat.com>
    Reported-by: 's avatarMichal Hocko <mhocko@suse.com>
    Acked-by: 's avatarMichal Hocko <mhocko@suse.com>
    Acked-by: 's avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Jann Horn <jannh@google.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
    Cc: Mike Kravetz <mike.kravetz@oracle.com>
    Cc: Peter Xu <peterx@redhat.com>
    Cc: Jason Gunthorpe <jgg@mellanox.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    dc30d2ce