mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts

[pandora-kernel.git] / mm / mmu_notifier.c

diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
index 3775c90..8d1ca2d 100644 (file)
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -37,49 +37,51 @@ static struct srcu_struct srcu;
 void __mmu_notifier_release(struct mm_struct *mm)
 {
        struct mmu_notifier *mn;
-       struct hlist_node *n;
        int id;
 
        /*
-        * SRCU here will block mmu_notifier_unregister until
-        * ->release returns.
+        * srcu_read_lock() here will block synchronize_srcu() in
+        * mmu_notifier_unregister() until all registered
+        * ->release() callouts this function makes have
+        * returned.
         */
        id = srcu_read_lock(&srcu);
-       hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist)
-               /*
-                * if ->release runs before mmu_notifier_unregister it
-                * must be handled as it's the only way for the driver
-                * to flush all existing sptes and stop the driver
-                * from establishing any more sptes before all the
-                * pages in the mm are freed.
-                */
-               if (mn->ops->release)
-                       mn->ops->release(mn, mm);
-       srcu_read_unlock(&srcu, id);
-
        spin_lock(&mm->mmu_notifier_mm->lock);
        while (unlikely(!hlist_empty(&mm->mmu_notifier_mm->list))) {
                mn = hlist_entry(mm->mmu_notifier_mm->list.first,
                                 struct mmu_notifier,
                                 hlist);
+
                /*
-                * We arrived before mmu_notifier_unregister so
-                * mmu_notifier_unregister will do nothing other than
-                * to wait ->release to finish and
-                * mmu_notifier_unregister to return.
+                * Unlink.  This will prevent mmu_notifier_unregister()
+                * from also making the ->release() callout.
                 */
                hlist_del_init_rcu(&mn->hlist);
+               spin_unlock(&mm->mmu_notifier_mm->lock);
+
+               /*
+                * Clear sptes. (see 'release' description in mmu_notifier.h)
+                */
+               if (mn->ops->release)
+                       mn->ops->release(mn, mm);
+
+               spin_lock(&mm->mmu_notifier_mm->lock);
        }
        spin_unlock(&mm->mmu_notifier_mm->lock);
 
        /*
-        * synchronize_srcu here prevents mmu_notifier_release to
-        * return to exit_mmap (which would proceed freeing all pages
-        * in the mm) until the ->release method returns, if it was
-        * invoked by mmu_notifier_unregister.
-        *
-        * The mmu_notifier_mm can't go away from under us because one
-        * mm_count is hold by exit_mmap.
+        * All callouts to ->release() which we have done are complete.
+        * Allow synchronize_srcu() in mmu_notifier_unregister() to complete
+        */
+       srcu_read_unlock(&srcu, id);
+
+       /*
+        * mmu_notifier_unregister() may have unlinked a notifier and may
+        * still be calling out to it.  Additionally, other notifiers
+        * may have been active via vmtruncate() et. al. Block here
+        * to ensure that all notifier callouts for this mm have been
+        * completed and the sptes are really cleaned up before returning
+        * to exit_mmap().
         */
        synchronize_srcu(&srcu);
 }
@@ -300,31 +302,31 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm)
 {
        BUG_ON(atomic_read(&mm->mm_count) <= 0);
 
+       spin_lock(&mm->mmu_notifier_mm->lock);
        if (!hlist_unhashed(&mn->hlist)) {
-               /*
-                * SRCU here will force exit_mmap to wait ->release to finish
-                * before freeing the pages.
-                */
                int id;
 
-               id = srcu_read_lock(&srcu);
                /*
-                * exit_mmap will block in mmu_notifier_release to
-                * guarantee ->release is called before freeing the
-                * pages.
+                * Ensure we synchronize up with __mmu_notifier_release().
                 */
+               id = srcu_read_lock(&srcu);
+
+               hlist_del_rcu(&mn->hlist);
+               spin_unlock(&mm->mmu_notifier_mm->lock);
+
                if (mn->ops->release)
                        mn->ops->release(mn, mm);
-               srcu_read_unlock(&srcu, id);
 
-               spin_lock(&mm->mmu_notifier_mm->lock);
-               hlist_del_rcu(&mn->hlist);
+               /*
+                * Allow __mmu_notifier_release() to complete.
+                */
+               srcu_read_unlock(&srcu, id);
+       } else
                spin_unlock(&mm->mmu_notifier_mm->lock);
-       }
 
        /*
-        * Wait any running method to finish, of course including
-        * ->release if it was run by mmu_notifier_relase instead of us.
+        * Wait for any running method to finish, including ->release() if it
+        * was run by __mmu_notifier_release() instead of us.
         */
        synchronize_srcu(&srcu);