In upcoming patches, do_madvise will be called from external process
context so we shouldn't asssume "current" is always hinted process's
task_struct. Furthermore, we couldn't access mm_struct via task->mm
once it's verified by access_mm which will be introduced in next
patch[1]. And let's pass *current* and current->mm as arguments of
do_madvise so it shouldn't change existing behavior but prepare
next patch to make review easy.

Note: io_madvise pass NULL as target_task argument of do_madvise
because it couldn't know who is target.

[1] http://lore.kernel.org/r/CAG48ez27=pwm5m_N_988xT1huO7g7h6arTQL44zev6TD-h-7Tg@mail.gmail.com (local)

Cc: Jens Axboe <axboe@kernel.dk>
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
---
 fs/io_uring.c      |  2 +-
 include/linux/mm.h |  3 ++-
 mm/madvise.c       | 34 +++++++++++++++++++---------------
 3 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 63beda9bafc5..a858da2ae2f4 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c

@@ -2736,7 +2736,7 @@ static int io_madvise(struct io_kiocb *req, struct io_kiocb **nxt,
        if (force_nonblock)
                return -EAGAIN;

-       ret = do_madvise(ma->addr, ma->len, ma->advice);
+       ret = do_madvise(NULL, req->work.mm, ma->addr, ma->len, ma->advice);
        if (ret < 0)
                req_set_fail_links(req);
        io_cqring_add_event(req, ret);

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 52269e56c514..bc16c8774328 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h

@@ -2323,7 +2323,8 @@ extern int __do_munmap(struct mm_struct *, unsigned long, size_t,
                       struct list_head *uf, bool downgrade);
 extern int do_munmap(struct mm_struct *, unsigned long, size_t,
                     struct list_head *uf);
-extern int do_madvise(unsigned long start, size_t len_in, int behavior);
+extern int do_madvise(struct task_struct *target_task, struct mm_struct *mm,
+               unsigned long start, size_t len_in, int behavior);

 static inline unsigned long
 do_mmap_pgoff(struct file *file, unsigned long addr,

diff --git a/mm/madvise.c b/mm/madvise.c
index 43b47d3fae02..f75c86b6c463 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c

@@ -254,6 +254,7 @@ static long madvise_willneed(struct vm_area_struct *vma,
                             struct vm_area_struct **prev,
                             unsigned long start, unsigned long end)
 {
+       struct mm_struct *mm = vma->vm_mm;
        struct file *file = vma->vm_file;
        loff_t offset;

@@ -288,12 +289,12 @@ static long madvise_willneed(struct vm_area_struct *vma,
         */
        *prev = NULL;   /* tell sys_madvise we drop mmap_sem */
        get_file(file);
-       up_read(&current->mm->mmap_sem);
+       up_read(&mm->mmap_sem);
        offset = (loff_t)(start - vma->vm_start)
                        + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
        vfs_fadvise(file, offset, end - start, POSIX_FADV_WILLNEED);
        fput(file);
-       down_read(&current->mm->mmap_sem);
+       down_read(&mm->mmap_sem);
        return 0;
 }

@@ -676,7 +677,6 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr,
        if (nr_swap) {
                if (current->mm == mm)
                        sync_mm_rss(mm);
-
                add_mm_counter(mm, MM_SWAPENTS, nr_swap);
        }
        arch_leave_lazy_mmu_mode();

@@ -756,6 +756,8 @@ static long madvise_dontneed_free(struct vm_area_struct *vma,
                                  unsigned long start, unsigned long end,
                                  int behavior)
 {
+       struct mm_struct *mm = vma->vm_mm;
+
        *prev = vma;
        if (!can_madv_lru_vma(vma))
                return -EINVAL;

@@ -763,8 +765,8 @@ static long madvise_dontneed_free(struct vm_area_struct *vma,
        if (!userfaultfd_remove(vma, start, end)) {
                *prev = NULL; /* mmap_sem has been dropped, prev is stale */

-               down_read(&current->mm->mmap_sem);
-               vma = find_vma(current->mm, start);
+               down_read(&mm->mmap_sem);
+               vma = find_vma(mm, start);
                if (!vma)
                        return -ENOMEM;
                if (start < vma->vm_start) {

@@ -818,6 +820,7 @@ static long madvise_remove(struct vm_area_struct *vma,
        loff_t offset;
        int error;
        struct file *f;
+       struct mm_struct *mm = vma->vm_mm;

        *prev = NULL;   /* tell sys_madvise we drop mmap_sem */

@@ -845,13 +848,13 @@ static long madvise_remove(struct vm_area_struct *vma,
        get_file(f);
        if (userfaultfd_remove(vma, start, end)) {
                /* mmap_sem was not released by userfaultfd_remove() */
-               up_read(&current->mm->mmap_sem);
+               up_read(&mm->mmap_sem);
        }
        error = vfs_fallocate(f,
                                FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
                                offset, end - start);
        fput(f);
-       down_read(&current->mm->mmap_sem);
+       down_read(&mm->mmap_sem);
        return error;
 }

@@ -1044,7 +1047,8 @@ madvise_behavior_valid(int behavior)
  *  -EBADF  - map exists, but area maps something that isn't a file.
  *  -EAGAIN - a kernel resource was temporarily unavailable.
  */
-int do_madvise(unsigned long start, size_t len_in, int behavior)
+int do_madvise(struct task_struct *target_task, struct mm_struct *mm,
+               unsigned long start, size_t len_in, int behavior)
 {
        unsigned long end, tmp;
        struct vm_area_struct *vma, *prev;

@@ -1082,10 +1086,10 @@ int do_madvise(unsigned long start, size_t len_in, int behavior)

        write = madvise_need_mmap_write(behavior);
        if (write) {
-               if (down_write_killable(&current->mm->mmap_sem))
+               if (down_write_killable(&mm->mmap_sem))
                        return -EINTR;
        } else {
-               down_read(&current->mm->mmap_sem);
+               down_read(&mm->mmap_sem);
        }

        /*

@@ -1093,7 +1097,7 @@ int do_madvise(unsigned long start, size_t len_in, int behavior)
         * ranges, just ignore them, but return -ENOMEM at the end.
         * - different from the way of handling in mlock etc.
         */
-       vma = find_vma_prev(current->mm, start, &prev);
+       vma = find_vma_prev(mm, start, &prev);
        if (vma && start > vma->vm_start)
                prev = vma;

@@ -1130,19 +1134,19 @@ int do_madvise(unsigned long start, size_t len_in, int behavior)
                if (prev)
                        vma = prev->vm_next;
                else    /* madvise_remove dropped mmap_sem */
-                       vma = find_vma(current->mm, start);
+                       vma = find_vma(mm, start);
        }
 out:
        blk_finish_plug(&plug);
        if (write)
-               up_write(&current->mm->mmap_sem);
+               up_write(&mm->mmap_sem);
        else
-               up_read(&current->mm->mmap_sem);
+               up_read(&mm->mmap_sem);

        return error;
 }

 SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
 {
-       return do_madvise(start, len_in, behavior);
+       return do_madvise(current, current->mm, start, len_in, behavior);
 }
--

2.25.0.265.gbab2e86ba0-goog