• Linus Torvalds's avatar
    mm: check that mm is still valid in madvise() · bc0c4d1e
    Linus Torvalds authored
    IORING_OP_MADVISE can end up basically doing mprotect() on the VM of
    another process, which means that it can race with our crazy core dump
    handling which accesses the VM state without holding the mmap_sem
    (because it incorrectly thinks that it is the final user).
    
    This is clearly a core dumping problem, but we've never fixed it the
    right way, and instead have the notion of "check that the mm is still
    ok" using mmget_still_valid() after getting the mmap_sem for writing in
    any situation where we're not the original VM thread.
    
    See commit 04f5866e ("coredump: fix race condition between
    mmget_not_zero()/get_task_mm() and core dumping") for more background on
    this whole mmget_still_valid() thing.  You might want to have a barf bag
    handy when you do.
    
    We're discussing just fixing this properly in the only remaining core
    dumping routines.  But even if we do that, let's make do_madvise() do
    the right thing, and then when we fix core dumping, we can remove all
    these mmget_still_valid() checks.
    Reported-and-tested-by: default avatarJann Horn <jannh@google.com>
    Fixes: c1ca757b ("io_uring: add IORING_OP_MADVISE")
    Acked-by: default avatarJens Axboe <axboe@kernel.dk>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    bc0c4d1e
madvise.c 29.5 KB