mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback
authorRalph Campbell <rcampbell@nvidia.com>
Tue, 30 Oct 2018 22:04:14 +0000 (15:04 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Wed, 31 Oct 2018 15:54:11 +0000 (08:54 -0700)
commit86a2d59841ab0b147ffc1b7b3041af87927cf312
treed10b1917669b769bfa3192228b05feec7f473e5f
parentaab8d0520e6e7c2a61f71195e6ce7007a4843afb
mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback

In hmm_mirror_unregister(), mm->hmm is set to NULL and then
mmu_notifier_unregister_no_release() is called.  That creates a small
window where mmu_notifier can call mmu_notifier_ops with mm->hmm equal to
NULL.  Fix this by first unregistering mmu notifier callbacks and then
setting mm->hmm to NULL.

Similarly in hmm_register(), set mm->hmm before registering mmu_notifier
callbacks so callback functions always see mm->hmm set.

Link: http://lkml.kernel.org/r/20181019160442.18723-4-jglisse@redhat.com
Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Jérôme Glisse <jglisse@redhat.com>
Reviewed-by: Balbir Singh <bsingharora@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/hmm.c