From f4b32b7f15433d69095bff1310ea7ce701bbee86 Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Wed, 12 Jul 2023 12:56:52 -0700 Subject: [PATCH] FROMGIT: mm: fix a lockdep issue in vma_assert_write_locked __is_vma_write_locked() can be used only when mmap_lock is write-locked to guarantee vm_lock_seq and mm_lock_seq stability during the check. Therefore it asserts this condition before further checks. Because of that it can't be used unless the user expects the mmap_lock to be write-locked. vma_assert_locked() can't assume this before ensuring that VMA is not read-locked. Change the order of the checks in vma_assert_locked() to check if the VMA is read-locked first and only then assert if it's not write-locked. Link: https://lkml.kernel.org/r/20230712195652.969194-1-surenb@google.com Fixes: 50b88b63e3e4 ("mm: handle userfaults under VMA lock") Signed-off-by: Suren Baghdasaryan Reported-by: Liam R. Howlett Closes: https://lore.kernel.org/all/20230712022620.3yytbdh24b7i4zrn@revolver/ Reported-by: syzbot+339b02f826caafd5f7a8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000002db68f05ffb791bc@google.com/ Cc: Christian Brauner Cc: Laurent Dufour Cc: Matthew Wilcox (Oracle) Cc: Michel Lespinasse Cc: Paul E. McKenney Cc: Vlastimil Babka Signed-off-by: Andrew Morton (cherry picked from commit 781537884e9905f2df812c8b754165dd606ae300 https: //git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Bug: 161210518 Change-Id: Ida7831576918000bb73850e639aae0d82f0c9fca Signed-off-by: Suren Baghdasaryan --- include/linux/mm.h | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 64eb00e3c58b..b2b3990aa1f6 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -673,6 +673,7 @@ static inline void vma_end_read(struct vm_area_struct *vma) rcu_read_unlock(); } +/* WARNING! Can only be used if mmap_lock is expected to be write-locked */ static bool __is_vma_write_locked(struct vm_area_struct *vma, int *mm_lock_seq) { mmap_assert_write_locked(vma->vm_mm); @@ -723,17 +724,6 @@ static inline bool vma_try_start_write(struct vm_area_struct *vma) return true; } -static inline void vma_assert_locked(struct vm_area_struct *vma) -{ - int mm_lock_seq; - - if (__is_vma_write_locked(vma, &mm_lock_seq)) - return; - - lockdep_assert_held(&vma->vm_lock->lock); - VM_BUG_ON_VMA(!rwsem_is_locked(&vma->vm_lock->lock), vma); -} - static inline void vma_assert_write_locked(struct vm_area_struct *vma) { int mm_lock_seq; @@ -741,6 +731,12 @@ static inline void vma_assert_write_locked(struct vm_area_struct *vma) VM_BUG_ON_VMA(!__is_vma_write_locked(vma, &mm_lock_seq), vma); } +static inline void vma_assert_locked(struct vm_area_struct *vma) +{ + if (!rwsem_is_locked(&vma->vm_lock->lock)) + vma_assert_write_locked(vma); +} + static inline void vma_mark_detached(struct vm_area_struct *vma, bool detached) { /* When detaching vma should be write-locked */