diff mbox series

[SRU,F,1/1] RDMA/odp: Ensure the mm is still alive before creating an implicit child

Message ID 20231215100343.32480-2-chengen.du@canonical.com
State New
Headers show
Series Page fault in RDMA ODP triggers BUG_ON during MMU notifier registration | expand

Commit Message

Chengen Du Dec. 15, 2023, 10:03 a.m. UTC 
From: Jason Gunthorpe <jgg@mellanox.com>

BugLink: https://bugs.launchpad.net/bugs/2046534

Registration of a mmu_notifier requires the caller to hold a mmget() on
the mm as registration is not permitted to race with exit_mmap(). There is
a BUG_ON inside the mmu_notifier to guard against this.

Normally creating a umem is done against current which implicitly holds
the mmget(), however an implicit ODP child is created from a pagefault
work queue and is not guaranteed to have a mmget().

Call mmget() around this registration and abort faulting if the MM has
gone to exit_mmap().

Before the patch below the notifier was registered when the implicit ODP
parent was created, so there was no chance to register a notifier outside
of current.

Fixes: c571feca2dc9 ("RDMA/odp: use mmu_notifier_get/put for 'struct ib_ucontext_per_mm'")
Link: https://lore.kernel.org/r/20200227114118.94736-1-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
(backported from commit a4e63bce1414df7ab6eb82ca9feb8494ce13e554)
[chengen - remove tgid-related code and adjust jump label from out_tgid
to out_mmput]
Signed-off-by: Chengen Du <chengen.du@canonical.com>
---
 drivers/infiniband/core/umem_odp.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 615e4ce0343b..0e9445cb5627 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -356,12 +356,26 @@  struct ib_umem_odp *ib_umem_odp_alloc_child(struct ib_umem_odp *root,
 	umem->owning_mm  = root->umem.owning_mm;
 	odp_data->page_shift = PAGE_SHIFT;
 
-	ret = ib_init_umem_odp(odp_data);
-	if (ret) {
-		kfree(odp_data);
-		return ERR_PTR(ret);
+	/*
+	 * A mmget must be held when registering a notifier, the owming_mm only
+	 * has a mm_grab at this point.
+	 */
+	if (!mmget_not_zero(umem->owning_mm)) {
+		ret = -EFAULT;
+		goto out_free;
 	}
+
+	ret = ib_init_umem_odp(odp_data);
+	if (ret)
+		goto out_mmput;
+	mmput(umem->owning_mm);
 	return odp_data;
+
+out_mmput:
+	mmput(umem->owning_mm);
+out_free:
+	kfree(odp_data);
+	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL(ib_umem_odp_alloc_child);