Linus Torvalds bc0c4d1e17 mm: check that mm is still valid in madvise() ... IORING_OP_MADVISE can end up basically doing mprotect() on the VM of another process, which means that it can race with our crazy core dump handling which accesses the VM state without holding the mmap_sem (because it incorrectly thinks that it is the final user). This is clearly a core dumping problem, but we've never fixed it the right way, and instead have the notion of "check that the mm is still ok" using mmget_still_valid() after getting the mmap_sem for writing in any situation where we're not the original VM thread. See commit 04f5866e41 ("coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping") for more background on this whole mmget_still_valid() thing. You might want to have a barf bag handy when you do. We're discussing just fixing this properly in the only remaining core dumping routines. But even if we do that, let's make do_madvise() do the right thing, and then when we fix core dumping, we can remove all these mmget_still_valid() checks. Reported-and-tested-by: Jann Horn <jannh@google.com> Fixes: c1ca757bd6 ("io_uring: add IORING_OP_MADVISE") Acked-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2020-04-24 13:28:03 -07:00
..
kasan	kasan: unset panic_on_warn before calling panic()	2020-04-07 10:43:44 -07:00
backing-dev.c	blkcg: rename blkcg->cgwb_refcnt to ->online_pin and always use it	2020-04-01 14:56:42 -06:00
balloon_compaction.c
cleancache.c
cma.c	mm: cma: NUMA node interface	2020-04-10 15:36:21 -07:00
cma.h
cma_debug.c
compaction.c	mm/compaction: add missing annotation for compact_lock_irqsave	2020-04-07 10:43:41 -07:00
debug.c	mm: dump_page(): additional diagnostics for huge pinned pages	2020-04-02 09:35:27 -07:00
debug_page_ref.c
dmapool.c	mm/dmapool.c: micro-optimisation remove unnecessary branch	2020-04-07 10:43:42 -07:00
early_ioremap.c
fadvise.c
failslab.c
filemap.c	mm: huge tmpfs: try to split_huge_page() when punching hole	2020-04-07 10:43:41 -07:00
frame_vector.c
frontswap.c
gup.c	mm, gup: return EINTR when gup is interrupted by fatal signals	2020-04-21 11:11:55 -07:00
gup_benchmark.c	mm/gup_benchmark: support pin_user_pages() and related calls	2020-04-02 09:35:27 -07:00
highmem.c
hmm.c	mm/hmm: return error for non-vma snapshots	2020-03-30 16:58:36 -03:00
huge_memory.c	userfaultfd: wp: support swap and page migration	2020-04-07 10:43:39 -07:00
hugetlb.c	mm/hugetlb: fix a addressing exception caused by huge_pte_offset	2020-04-21 11:11:55 -07:00
hugetlb_cgroup.c	mm: use fallthrough;	2020-04-07 10:43:41 -07:00
hwpoison-inject.c
init-mm.c
internal.h	mm: add function __putback_isolated_page	2020-04-07 10:43:38 -07:00
interval_tree.c
Kconfig	libnvdimm for 5.7	2020-04-08 21:03:40 -07:00
Kconfig.debug
khugepaged.c	khugepaged: skip collapse if uffd-wp detected	2020-04-07 10:43:39 -07:00
kmemleak-test.c
kmemleak.c	mm/kmemleak.c: use address-of operator on section symbols	2020-04-02 09:35:26 -07:00
ksm.c	mm/ksm: fix NULL pointer dereference when KSM zero page is enabled	2020-04-21 11:11:55 -07:00
list_lru.c	mm: use fallthrough;	2020-04-07 10:43:41 -07:00
maccess.c
madvise.c	mm: check that mm is still valid in madvise()	2020-04-24 13:28:03 -07:00
Makefile	mm: introduce Reported pages	2020-04-07 10:43:38 -07:00
mapping_dirty_helpers.c	mm/mapping_dirty_helpers: update huge page-table entry callbacks	2020-04-02 09:35:29 -07:00
memblock.c	mm: cma: NUMA node interface	2020-04-10 15:36:21 -07:00
memcontrol.c	mm, memcg: do not high throttle allocators based on wraparound	2020-04-10 15:36:20 -07:00
memfd.c
memory-failure.c	mm: code cleanup for MADV_FREE	2020-04-07 10:43:38 -07:00
memory.c	mm/memory.c: add vm_insert_pages()	2020-04-10 15:36:21 -07:00
memory_hotplug.c	mm/memory_hotplug: add pgprot_t to mhp_params	2020-04-10 15:36:21 -07:00
mempolicy.c	libnvdimm for 5.7	2020-04-08 21:03:40 -07:00
mempool.c
memremap.c	mm/memremap: set caching mode for PCI P2PDMA memory to WC	2020-04-10 15:36:21 -07:00
memtest.c
migrate.c	userfaultfd: wp: support swap and page migration	2020-04-07 10:43:39 -07:00
mincore.c
mlock.c
mm_init.c	mm/mm_init.c: clean code. Use BUILD_BUG_ON when comparing compile time constant	2020-04-07 10:43:41 -07:00
mmap.c	mm/vma: introduce VM_ACCESS_FLAGS	2020-04-10 15:36:21 -07:00
mmu_context.c
mmu_gather.c
mmu_notifier.c	mm/mmu_notifier: silence PROVE_RCU_LIST warnings	2020-03-21 18:56:06 -07:00
mmzone.c
mprotect.c	mm/vma: introduce VM_ACCESS_FLAGS	2020-04-10 15:36:21 -07:00
mremap.c	mm: Fix MREMAP_DONTUNMAP accounting on VMA merge	2020-04-19 14:07:10 -07:00
msync.c
nommu.c	x86/mm: split vmalloc_sync_all()	2020-03-21 18:56:06 -07:00
oom_kill.c
page-writeback.c	mm/gup/writeback: add callbacks for inaccessible pages	2020-04-02 09:35:27 -07:00
page_alloc.c	mm/page_alloc: make pcpu_drain_mutex and pcpu_drain static	2020-04-10 15:36:21 -07:00
page_counter.c	mm, memcg: prevent memory.min load/store tearing	2020-04-02 09:35:29 -07:00
page_ext.c	mm/page_ext.c: drop pfn_present() check when onlining	2020-04-07 10:43:40 -07:00
page_idle.c
page_io.c
page_isolation.c	mm: add function __putback_isolated_page	2020-04-07 10:43:38 -07:00
page_owner.c
page_poison.c
page_reporting.c	mm/page_reporting: add budget limit on how many pages can be reported per pass	2020-04-07 10:43:39 -07:00
page_reporting.h	mm: introduce Reported pages	2020-04-07 10:43:38 -07:00
page_vma_mapped.c
pagewalk.c
percpu-internal.h
percpu-km.c
percpu-stats.c	percpu: update copyright emails to dennis@kernel.org	2020-04-01 10:09:12 -07:00
percpu-vm.c
percpu.c	percpu: update copyright emails to dennis@kernel.org	2020-04-01 10:09:12 -07:00
pgtable-generic.c
process_vm_access.c	mm: docs: Fix a comment in process_vm_rw_core	2020-03-25 10:04:01 -05:00
ptdump.c
readahead.c
rmap.c	mm: prevent a warning when casting void* -> enum	2020-04-07 10:43:41 -07:00
rodata_test.c
shmem.c	mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path	2020-04-21 11:11:56 -07:00
shuffle.c	mm: adjust shuffle code to allow for future coalescing	2020-04-07 10:43:38 -07:00
shuffle.h	mm: adjust shuffle code to allow for future coalescing	2020-04-07 10:43:38 -07:00
slab.c
slab.h	mm: kmem: rename (__)memcg_kmem_(un)charge_memcg() to __memcg_kmem_(un)charge()	2020-04-02 09:35:28 -07:00
slab_common.c	mm, slab_common: fix a typo in comment "eariler"->"earlier"	2020-04-10 15:36:20 -07:00
slob.c
slub.c	slub: avoid redzone when choosing freepointer location	2020-04-21 11:11:55 -07:00
sparse-vmemmap.c
sparse.c	mm/sparse.c: move subsection_map related functions together	2020-04-07 10:43:40 -07:00
swap.c	mm: huge tmpfs: try to split_huge_page() when punching hole	2020-04-07 10:43:41 -07:00
swap_cgroup.c
swap_slots.c	mm/swap_slots.c: assign|reset cache slot by value directly	2020-04-02 09:35:27 -07:00
swap_state.c	mm/swap_state.c: use the same way to count page in [add_to|delete_from]_swap_cache	2020-04-02 09:35:28 -07:00
swapfile.c	proc: faster open/read/close with "permanent" files	2020-04-07 10:43:42 -07:00
truncate.c
usercopy.c
userfaultfd.c	userfaultfd: wp: support write protection for userfault vma range	2020-04-07 10:43:39 -07:00
util.c
vmacache.c
vmalloc.c	vmalloc: fix remap_vmalloc_range() bounds checks	2020-04-21 11:11:56 -07:00
vmpressure.c	mm: vmpressure: use mem_cgroup_is_root API	2020-04-02 09:35:31 -07:00
vmscan.c	mm: code cleanup for MADV_FREE	2020-04-07 10:43:38 -07:00
vmstat.c	mm, thp: track fallbacks due to failed memcg charges separately	2020-04-07 10:43:38 -07:00
workingset.c
z3fold.c	mm/z3fold.c: do not include rwlock.h directly	2020-03-06 07:06:09 -06:00
zbud.c
zpool.c
zsmalloc.c	mm: use fallthrough;	2020-04-07 10:43:41 -07:00
zswap.c	mm/zswap: allow setting default status, compressor and allocator in Kconfig	2020-04-07 10:43:41 -07:00