LKML Archive on
help / color / mirror / Atom feed
From: John Hubbard <>
To: Jerome Glisse <>,
	Andrew Morton <>
Cc: <>, <>,
	Ralph Campbell <>,
	Evgeny Baskakov <>,
	Mark Hairgrove <>
Subject: Re: [PATCH 3/4] mm/hmm: HMM should have a callback before MM is destroyed
Date: Thu, 15 Mar 2018 18:17:24 -0700	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On 03/15/2018 05:54 PM, Jerome Glisse wrote:
> On Thu, Mar 15, 2018 at 03:48:29PM -0700, Andrew Morton wrote:
>> On Thu, 15 Mar 2018 14:36:59 -0400 wrote:
>>> From: Ralph Campbell <>
>>> The hmm_mirror_register() function registers a callback for when
>>> the CPU pagetable is modified. Normally, the device driver will
>>> call hmm_mirror_unregister() when the process using the device is
>>> finished. However, if the process exits uncleanly, the struct_mm
>>> can be destroyed with no warning to the device driver.
>> The changelog doesn't tell us what the runtime effects of the bug are. 
>> This makes it hard for me to answer the "did Jerome consider doing
>> cc:stable" question.
> The impact is low, they might be issue only if application is kill,
> and we don't have any upstream user yet hence why i did not cc
> stable.

Hi Jerome and Andrew,

I'd claim that it is not possible to make a safe and correct device
driver, without this patch. That's because, without the .release callback
that you're adding here, the driver could end up doing operations on a 
stale struct_mm, leading to crashes and other disasters.

Even if people think that maybe that window is "small", it's not really
any smaller than lots of race condition problems that we've seen. And
it is definitely not that hard to hit it: just a good directed stress
test involving multiple threads that are doing early process termination
while also doing lots of migrations and page faults, should suffice.

It is probably best to add this patch to stable, for that reason. 

John Hubbard

  reply	other threads:[~2018-03-16  1:17 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-15 18:36 [PATCH 0/4] hmm: fixes and documentations jglisse
2018-03-15 18:36 ` [PATCH 1/4] mm/hmm: documentation editorial update to HMM documentation jglisse
2018-03-15 18:36 ` [PATCH 2/4] mm/hmm: fix header file if/else/endif maze jglisse
2018-03-16  0:11   ` Balbir Singh
2018-03-17  0:53   ` kbuild test robot
2018-03-15 18:36 ` [PATCH 3/4] mm/hmm: HMM should have a callback before MM is destroyed jglisse
2018-03-15 22:48   ` Andrew Morton
2018-03-16  0:54     ` Jerome Glisse
2018-03-16  1:17       ` John Hubbard [this message]
2018-03-20 11:33     ` Michal Hocko
2018-03-20 14:45       ` Jerome Glisse
2018-03-15 18:37 ` [PATCH 4/4] mm/hmm: change CPU page table snapshot functions to simplify drivers jglisse
2018-03-16  5:08   ` John Hubbard
2018-03-16 19:19     ` Jerome Glisse

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).