On Mon, 2018-06-18 at 12:14:36 UTC, Frederic Barrat wrote: > If a process exits without doing proper cleanup, there's a window > where an opencapi device can try to access the memory of the dying > process and may trigger a page fault. That's an expected scenario and > the ocxl driver holds a reference on the mm_struct of the process > until the opencapi device is notified of the process exiting. > However, if mm_users is already at 0, i.e. the address space of the > process has already been destroyed, the driver shouldn't try resolving > the page fault, as it will fail, but it can also try accessing already > freed data. > > It is fixed by only calling the bottom half of the page fault handler > if mm_users is greater than 0 and get a reference on mm_users instead > of mm_count. Otherwise, we can safely return a translation fault to > the device, as its associated memory context is being removed. The > opencapi device will be properly cleaned up shortly after when closing > the file descriptors. > > Fixes: 5ef3166e8a32 ("ocxl: Driver code for 'generic' opencapi devices") > Cc: sta...@vger.kernel.org # v4.16+ > Signed-off-by: Frederic Barrat <fbar...@linux.ibm.com> > Reviewed-By: Alastair D'Silva <alast...@d-silva.org> > Acked-by: Andrew Donnellan <andrew.donnel...@au1.ibm.com>
Applied to powerpc next, thanks. https://git.kernel.org/powerpc/c/d497ebf5fb3a026c0817f8c96cde57 cheers