On Fri, Aug 24, 2018 at 03:25:45PM -0400, jglisse@redhat.com wrote:

From: Ralph Campbell <redacted>

In hmm_mirror_unregister(), mm->hmm is set to NULL and then
mmu_notifier_unregister_no_release() is called. That creates a small
window where mmu_notifier can call mmu_notifier_ops with mm->hmm equal
to NULL. Fix this by first unregistering mmu notifier callbacks and
then setting mm->hmm to NULL.

Similarly in hmm_register(), set mm->hmm before registering mmu_notifier
callbacks so callback functions always see mm->hmm set.

Signed-off-by: Ralph Campbell <redacted>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Jérôme Glisse <redacted>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org

Reviewed-by: Balbir Singh <bsingharora@gmail.com>