anierin/msm-5.15
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ANDROID: mm: fix vma refcounting for SPF in vm_area_dup

Browse Source 
vm_area_dup() should reset the vma refcount to avoid leaking the newly
created vma in case the original vma being copies has an elevated
refcount due to concurrent page fault.

Fixes: d9d7f843da ("ANDROID: mm: introduce vma refcounting to protect vma during SPF")
Bug: 253557903
Change-Id: I11324ac5661823e9c97b71afe6a894a094439960
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
This commit is contained in:
Suren Baghdasaryan
2023-01-09 09:56:50 -08:00
parent 1b8d144a47
commit c24377e58a
2 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
include/linux/mm.h
View File

@@ -679,6 +679,15 @@ struct vm_operations_struct {
ANDROID_KABI_RESERVE(4);
};
static inline void INIT_VMA(struct vm_area_struct *vma)
{
#ifdef CONFIG_SPECULATIVE_PAGE_FAULT
/* Start from 0 to use atomic_inc_unless_negative() in get_vma() */
atomic_set(&vma->file_ref_count, 0);
#endif
INIT_LIST_HEAD(&vma->anon_vma_chain);
}
static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
{
static const struct vm_operations_struct dummy_vm_ops = {};
@@ -686,11 +695,7 @@ static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
memset(vma, 0, sizeof(*vma));
vma->vm_mm = mm;
vma->vm_ops = &dummy_vm_ops;
#ifdef CONFIG_SPECULATIVE_PAGE_FAULT
/* Start from 0 to use atomic_inc_unless_negative() in get_vma() */
atomic_set(&vma->file_ref_count, 0);
#endif
INIT_LIST_HEAD(&vma->anon_vma_chain);
INIT_VMA(vma);
}
static inline void vma_set_anonymous(struct vm_area_struct *vma)

2
kernel/fork.c
View File

@@ -374,7 +374,7 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
* will be reinitialized.
*/
*new = data_race(*orig);
INIT_LIST_HEAD(&new->anon_vma_chain);
INIT_VMA(new);
new->vm_next = new->vm_prev = NULL;
dup_anon_vma_name(orig, new);
}