Re: [RFC PATCH] binfmt_elf: Protect mm_struct access with mmap_sem

2019-06-12 Thread Cyrill Gorcunov
On Wed, Jun 12, 2019 at 10:51:59AM -0700, Matthew Wilcox wrote: > On Wed, Jun 12, 2019 at 07:29:15PM +0200, Michal Koutný wrote: > > On Wed, Jun 12, 2019 at 10:00:34AM -0700, Matthew Wilcox > > wrote: > > > On Wed, Jun 12, 2019 at 04:28:11PM +0200, Michal Koutný wrote: > > > > - /* N.B.

Re: [RFC PATCH] binfmt_elf: Protect mm_struct access with mmap_sem

2019-06-12 Thread Cyrill Gorcunov
On Wed, Jun 12, 2019 at 04:28:11PM +0200, Michal Koutný wrote: > find_extend_vma assumes the caller holds mmap_sem as a reader (explained > in expand_downwards()). The path when we are extending the stack VMA to > accomodate argv[] pointers happens without the lock. > > I was not able to cause an

Re: [RFC PATCH] binfmt_elf: Protect mm_struct access with mmap_sem

2019-06-12 Thread Matthew Wilcox
On Wed, Jun 12, 2019 at 07:29:15PM +0200, Michal Koutný wrote: > On Wed, Jun 12, 2019 at 10:00:34AM -0700, Matthew Wilcox > wrote: > > On Wed, Jun 12, 2019 at 04:28:11PM +0200, Michal Koutný wrote: > > > - /* N.B. passed_fileno might not be initialized? */ > > > + > > > > Why did you delete

Re: [RFC PATCH] binfmt_elf: Protect mm_struct access with mmap_sem

2019-06-12 Thread Michal Koutný
On Wed, Jun 12, 2019 at 10:00:34AM -0700, Matthew Wilcox wrote: > On Wed, Jun 12, 2019 at 04:28:11PM +0200, Michal Koutný wrote: > > - /* N.B. passed_fileno might not be initialized? */ > > + > > Why did you delete this comment? The variable got removed in d20894a23708 ("Remove a.out

Re: [RFC PATCH] binfmt_elf: Protect mm_struct access with mmap_sem

2019-06-12 Thread Matthew Wilcox
On Wed, Jun 12, 2019 at 04:28:11PM +0200, Michal Koutný wrote: > - /* N.B. passed_fileno might not be initialized? */ > + Why did you delete this comment?

[RFC PATCH] binfmt_elf: Protect mm_struct access with mmap_sem

2019-06-12 Thread Michal Koutný
find_extend_vma assumes the caller holds mmap_sem as a reader (explained in expand_downwards()). The path when we are extending the stack VMA to accomodate argv[] pointers happens without the lock. I was not able to cause an mm_struct corruption but BUG_ON(!rwsem_is_locked(>mmap_sem)) in