| Message ID | 20220525081822.53547-2-linmiaohe@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | A few cleanup and fixup patches for migration | expand |
On Wed, May 25, 2022 at 04:18:19PM +0800, Miaohe Lin wrote: > Commit 3268c63eded4 ("mm: fix move/migrate_pages() race on task struct") > extends the period of the rcu_read_lock until after the permissions checks > are done to prevent the task pointed to from changing from under us. But > the task_struct refcount is also taken at that time, the reference to task > is guaranteed to be stable. So it's unnecessary to extend the period of > the rcu_read_lock. Release the rcu lock after task refcount is successfully > grabbed to reduce the rcu holding time. > > Reviewed-by: Muchun Song <songmuchun@bytedance.com> > Reviewed-by: Christoph Hellwig <hch@lst.de> > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > Cc: Huang Ying <ying.huang@intel.com> > Cc: David Howells <dhowells@redhat.com> > Cc: Christoph Lameter <cl@linux.com> Reviewed-by: Oscar Salvador <osalvador@suse.de> > --- > mm/mempolicy.c | 3 +-- > mm/migrate.c | 3 +-- > 2 files changed, 2 insertions(+), 4 deletions(-) > > diff --git a/mm/mempolicy.c b/mm/mempolicy.c > index 0b4ba3ee810e..2dad094177bf 100644 > --- a/mm/mempolicy.c > +++ b/mm/mempolicy.c > @@ -1609,6 +1609,7 @@ static int kernel_migrate_pages(pid_t pid, unsigned long maxnode, > goto out; > } > get_task_struct(task); > + rcu_read_unlock(); > > err = -EINVAL; > > @@ -1617,11 +1618,9 @@ static int kernel_migrate_pages(pid_t pid, unsigned long maxnode, > * Use the regular "ptrace_may_access()" checks. > */ > if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) { > - rcu_read_unlock(); > err = -EPERM; > goto out_put; > } > - rcu_read_unlock(); > > task_nodes = cpuset_mems_allowed(task); > /* Is the user allowed to access the target nodes? */ > diff --git a/mm/migrate.c b/mm/migrate.c > index e51588e95f57..e88ebb88fa6f 100644 > --- a/mm/migrate.c > +++ b/mm/migrate.c > @@ -1902,17 +1902,16 @@ static struct mm_struct *find_mm_struct(pid_t pid, nodemask_t *mem_nodes) > return ERR_PTR(-ESRCH); > } > get_task_struct(task); > + rcu_read_unlock(); > > /* > * Check if this process has the right to modify the specified > * process. Use the regular "ptrace_may_access()" checks. > */ > if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) { > - rcu_read_unlock(); > mm = ERR_PTR(-EPERM); > goto out; > } > - rcu_read_unlock(); > > mm = ERR_PTR(security_task_movememory(task)); > if (IS_ERR(mm)) > -- > 2.23.0 > >
diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 0b4ba3ee810e..2dad094177bf 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -1609,6 +1609,7 @@ static int kernel_migrate_pages(pid_t pid, unsigned long maxnode, goto out; } get_task_struct(task); + rcu_read_unlock(); err = -EINVAL; @@ -1617,11 +1618,9 @@ static int kernel_migrate_pages(pid_t pid, unsigned long maxnode, * Use the regular "ptrace_may_access()" checks. */ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) { - rcu_read_unlock(); err = -EPERM; goto out_put; } - rcu_read_unlock(); task_nodes = cpuset_mems_allowed(task); /* Is the user allowed to access the target nodes? */ diff --git a/mm/migrate.c b/mm/migrate.c index e51588e95f57..e88ebb88fa6f 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1902,17 +1902,16 @@ static struct mm_struct *find_mm_struct(pid_t pid, nodemask_t *mem_nodes) return ERR_PTR(-ESRCH); } get_task_struct(task); + rcu_read_unlock(); /* * Check if this process has the right to modify the specified * process. Use the regular "ptrace_may_access()" checks. */ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) { - rcu_read_unlock(); mm = ERR_PTR(-EPERM); goto out; } - rcu_read_unlock(); mm = ERR_PTR(security_task_movememory(task)); if (IS_ERR(mm))
Commit 3268c63eded4 ("mm: fix move/migrate_pages() race on task struct") extends the period of the rcu_read_lock until after the permissions checks are done to prevent the task pointed to from changing from under us. But the task_struct refcount is also taken at that time, the reference to task is guaranteed to be stable. So it's unnecessary to extend the period of the rcu_read_lock. Release the rcu lock after task refcount is successfully grabbed to reduce the rcu holding time. Reviewed-by: Muchun Song <songmuchun@bytedance.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Cc: Huang Ying <ying.huang@intel.com> Cc: David Howells <dhowells@redhat.com> Cc: Christoph Lameter <cl@linux.com> --- mm/mempolicy.c | 3 +-- mm/migrate.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)