Commit 6d27a31e authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Andrew Morton
Browse files

uprobes: introduce the global struct vm_special_mapping xol_mapping 

Currently each xol_area has its own instance of vm_special_mapping, this
is suboptimal and ugly.  Kill xol_area->xol_mapping and add a single
global instance of vm_special_mapping, the ->fault() method can use
area->pages rather than xol_mapping->pages.

As a side effect this fixes the problem introduced by the recent commit
223febc6 ("mm: add optional close() to struct vm_special_mapping"), if
special_mapping_close() is called from the __mmput() paths, it will use
vma->vm_private_data = &area->xol_mapping freed by uprobe_clear_state().

Link: https://lkml.kernel.org/r/20240911131407.GB3448@redhat.com


Fixes: 223febc6 ("mm: add optional close() to struct vm_special_mapping")
Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Reported-by: default avatarSven Schnelle <svens@linux.ibm.com>
Closes: https://lore.kernel.org/all/yt9dy149vprr.fsf@linux.ibm.com/


Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent ed8d5b0c

kernel/events/uprobes.c

+16 −5
Original line number Diff line number Diff line
@@ -99,7 +99,6 @@ struct xol_area { 
	atomic_t 			slot_count;	/* number of in-use slots */

	unsigned long 			*bitmap;	/* 0 = free slot */



	struct vm_special_mapping	xol_mapping;

	struct page 			*pages[2];

	/*

	 * We keep the vma's vm_start rather than a pointer to the vma
@@ -1433,6 +1432,21 @@ void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned lon 
		set_bit(MMF_RECALC_UPROBES, &vma->vm_mm->flags);

}



static vm_fault_t xol_fault(const struct vm_special_mapping *sm,

			    struct vm_area_struct *vma, struct vm_fault *vmf)

{

	struct xol_area *area = vma->vm_mm->uprobes_state.xol_area;



	vmf->page = area->pages[0];

	get_page(vmf->page);

	return 0;

}



static const struct vm_special_mapping xol_mapping = {

	.name = "[uprobes]",

	.fault = xol_fault,

};



/* Slot allocation for XOL */

static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)

{
@@ -1459,7 +1473,7 @@ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area) 


	vma = _install_special_mapping(mm, area->vaddr, PAGE_SIZE,

				VM_EXEC|VM_MAYEXEC|VM_DONTCOPY|VM_IO,

				&area->xol_mapping);

				&xol_mapping);

	if (IS_ERR(vma)) {

		ret = PTR_ERR(vma);

		goto fail;
@@ -1498,9 +1512,6 @@ static struct xol_area *__create_xol_area(unsigned long vaddr) 
	if (!area->bitmap)

		goto free_area;



	area->xol_mapping.name = "[uprobes]";

	area->xol_mapping.fault = NULL;

	area->xol_mapping.pages = area->pages;

	area->pages[0] = alloc_page(GFP_HIGHUSER);

	if (!area->pages[0])

		goto free_bitmap;