Thread (27 messages) 27 messages, 6 authors, 2023-07-08

Re: Fwd: Memory corruption in multithreaded user space program while calling fork

From: Andrew Morton <akpm@linux-foundation.org>
Date: 2023-07-08 17:39:42
Also in: linux-mm, linuxppc-dev, lkml, regressions

On Sat, 8 Jul 2023 10:29:42 -0700 Linus Torvalds [off-list ref] wrote:
On Sat, 8 Jul 2023 at 04:35, Thorsten Leemhuis
[off-list ref] wrote:
quoted
The plan since early this week is to mark CONFIG_PER_VMA_LOCK as broken;
latest patch that does this is this one afaics:
Bah.

Both marking it as broken and the pending fix seems excessive.

Why isn't the trivial fix just to say "yes, fork() gets the mmap_lock
for writing for a reason, and that reason is that it acts kind of like
mprotect()".

And then just do what those functions do.

IOW, why isn't the fix just to do

  --- a/kernel/fork.c
  +++ b/kernel/fork.c
  @@ -686,6 +686,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
        for_each_vma(old_vmi, mpnt) {
                struct file *file;

  +             vma_start_write(mpnt);
                if (mpnt->vm_flags & VM_DONTCOPY) {
                        vm_stat_account(mm, mpnt->vm_flags, -vma_pages(mpnt));
                        continue;

and be done with this? Yes, we could move it down a bit more, ignoring
the VM_DONTCOPY vma's, but they are so uncommon as to not matter, so
who cares?
That was the v1 fix, but after some discussion
(https://lkml.kernel.org/r/20230705063711.2670599-1-surenb@google.com)
it was decided to take the "excessive" approach.

Also, this change needs a couple more updates:
https://lkml.kernel.org/r/20230707043211.3682710-1-surenb@google.com
https://lkml.kernel.org/r/20230707043211.3682710-2-surenb@google.com

So I'm thinking it's best to disable the feature in 6.4.x and reenable
it for 6.5 once all this is sorted out.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help