On Sat, Mar 02, 2019 at 04:11:26PM +0100, Jan Stancek wrote: > Problem is that "vmf->vma" used in do_fault() can become stale. > Because mmap_sem may be released, other threads can come in, > call munmap() and cause "vma" be returned to kmem cache, and > get zeroed/re-initialized and re-used:
> This patch pins mm_struct and stores its value, to avoid using > potentially stale "vma" when calling pte_free(). OK, we need to cache the mm_struct, but why do we need the extra atomic op? There's surely no way the mm can be freed while the thread is in the middle of handling a fault. ie I would drop these lines: > + mmgrab(vm_mm); > + ... > + > + mmdrop(vm_mm); > +
