From nobody Sun Oct 5 05:29:30 2025 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50EEA283FD8 for ; Fri, 8 Aug 2025 15:28:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754666939; cv=none; b=tNOC5VtZO+6rs221j1fIokT8hGd1qwj87YQB5pNyBX+O6kGuthcLacrcOY8aV5Am7Gc2dNM0vNtGu8aALJAfdH8X2xvEM8qWDPcrKBHhKTvJbgURkSnXW9vqgMjjQQ5XZe6zctRoLfWh6TX19pmTju4tA0C8P93qru0jnskTL9c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754666939; c=relaxed/simple; bh=XKTEUe7EpZmwdErMVrUj/4YyKjdTs+8FZq2bP4a5ses=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=HU615CspZsXEX/vDG2yKs+fXJNWCwghTLGSob26ZNZT3mCF4TNQOOna0/AaRRCyvD7wIPMo+cR1pWHPiMJOLZ0T1q9dAUPl0MbRnI0irCnQQU8ncE0VKdfBP+PzjnMoM0DegpuN4IOCGeiHAB1tm4geZXZzh8yZYVLM2Kn+4IV4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--surenb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Tom1YOuC; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--surenb.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Tom1YOuC" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-240012b74dfso17968755ad.2 for ; Fri, 08 Aug 2025 08:28:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1754666935; x=1755271735; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=S8RI3/a/LEClfHbNax20K5D92my9/tqwTk/caS4KXZA=; b=Tom1YOuCa1wHyPTmsR3kIN8s9VxJc/jKSRKg+S2DgyvWB5kpKmmFV7QTM0X1pPlhuU 4uIjhAHo18ykbAJE0GwyFSCeeXclb0lAPZjyM4rMLV34I37jIp4pQe6tlNV1v6630b/2 p7kiWkoNax5zE2NDNWbBz6SuL4ctIo+3+sUp0SU8ZGXIcydcA+Vc1/GY3YzO5EspUXjb sQMPe16dbWHP7Tkfpu5hqHeOxQlfpvYwybm4YFH+m6PuWwvNzcZ3Dfq98Con/ASsf41V M/Ud6x29aRC4Hpb7lPr3n4J44yK6x2M8HJjilMBGiAMNS0UJFADyIHTUgrnTE1isn1US NUSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1754666935; x=1755271735; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=S8RI3/a/LEClfHbNax20K5D92my9/tqwTk/caS4KXZA=; b=EYIxGIHJVgD6XM4nzdLPE29tTfI41Bv2662j2/KinPrAzEshobnmp9mPK3K1Lm8Hag KXWyF4u5a9CZV/2gwu7Nb8RGPt3mJW1Y1oxd+WdqjhoroEoc3osFOstPo2rlu4FA6IBq 56K8exvpIAGhtKAdmCnnCqzIvwrpUOEClTGe7ERAmg0P1NwZRVnPUdmhTswQjRA+nttO JLYw9sB0aJZxt8LORzRqE0iJM6a4qNHx7TGcoBmyXwCvRordxrDTQeA1AG9Dke4HwCoO k5mJ3LXWqY3KhHlMhXCnTH/P1uvSlNqRC0BCRyrdnHtJbUKT9Ze3QIj7i8ponzqFJKfo Q8hA== X-Forwarded-Encrypted: i=1; AJvYcCWmVtKAJfGtF9eW4jH9XswkGo8QmjxCNEMQGwlM8dtsTUIZmOVNNRn67pzvJNO1yNn9fEuC4S6CDW1pJm0=@vger.kernel.org X-Gm-Message-State: AOJu0YzK3rdPhS9ghSKp1k4FV6U/B5AXJ51PdqLSSjO1bvozqT7VTb4X 4appWG60Kb41q2Ev7cyzFn0iAOi2kP12seI3pSGdf7VReLbwTYEVaIS8cS31K7nQPmudJVGQKEB lGDWH9g== X-Google-Smtp-Source: AGHT+IE+DfdsmL2T51tGBXmSDKHhykJ4R796cnuth2Y+HKuXvkKdRqWEuUnZeBDrebjvi1qQ6D/RrsYt7R4= X-Received: from plzt11.prod.google.com ([2002:a17:902:bc4b:b0:23d:ecc7:14e6]) (user=surenb job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:ebc6:b0:242:9bbc:3644 with SMTP id d9443c01a7336-242c225a177mr50512595ad.54.1754666935527; Fri, 08 Aug 2025 08:28:55 -0700 (PDT) Date: Fri, 8 Aug 2025 08:28:47 -0700 In-Reply-To: <20250808152850.2580887-1-surenb@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20250808152850.2580887-1-surenb@google.com> X-Mailer: git-send-email 2.50.1.703.g449372360f-goog Message-ID: <20250808152850.2580887-2-surenb@google.com> Subject: [PATCH v4 1/3] selftests/proc: test PROCMAP_QUERY ioctl while vma is concurrently modified From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: Liam.Howlett@oracle.com, lorenzo.stoakes@oracle.com, david@redhat.com, vbabka@suse.cz, peterx@redhat.com, jannh@google.com, hannes@cmpxchg.org, mhocko@kernel.org, paulmck@kernel.org, shuah@kernel.org, adobriyan@gmail.com, brauner@kernel.org, josef@toxicpanda.com, yebin10@huawei.com, linux@weissschuh.net, willy@infradead.org, osalvador@suse.de, andrii@kernel.org, ryan.roberts@arm.com, christophe.leroy@csgroup.eu, tjmercier@google.com, kaleshsingh@google.com, aha310510@gmail.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, surenb@google.com, SeongJae Park Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Extend /proc/pid/maps tearing tests to verify PROCMAP_QUERY ioctl operation correctness while the vma is being concurrently modified. Signed-off-by: Suren Baghdasaryan Tested-by: SeongJae Park Acked-by: SeongJae Park Reviewed-by: Lorenzo Stoakes --- tools/testing/selftests/proc/proc-maps-race.c | 65 +++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/tools/testing/selftests/proc/proc-maps-race.c b/tools/testing/= selftests/proc/proc-maps-race.c index 94bba4553130..a546475db550 100644 --- a/tools/testing/selftests/proc/proc-maps-race.c +++ b/tools/testing/selftests/proc/proc-maps-race.c @@ -32,6 +32,8 @@ #include #include #include +#include +#include #include #include #include @@ -317,6 +319,25 @@ static bool capture_mod_pattern(FIXTURE_DATA(proc_maps= _race) *self, strcmp(restored_first_line->text, self->first_line.text) =3D=3D 0; } =20 +static bool query_addr_at(int maps_fd, void *addr, + unsigned long *vma_start, unsigned long *vma_end) +{ + struct procmap_query q; + + memset(&q, 0, sizeof(q)); + q.size =3D sizeof(q); + /* Find the VMA at the split address */ + q.query_addr =3D (unsigned long long)addr; + q.query_flags =3D 0; + if (ioctl(maps_fd, PROCMAP_QUERY, &q)) + return false; + + *vma_start =3D q.vma_start; + *vma_end =3D q.vma_end; + + return true; +} + static inline bool split_vma(FIXTURE_DATA(proc_maps_race) *self) { return mmap(self->mod_info->addr, self->page_size, self->mod_info->prot |= PROT_EXEC, @@ -559,6 +580,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) do { bool last_line_changed; bool first_line_changed; + unsigned long vma_start; + unsigned long vma_end; =20 ASSERT_TRUE(read_boundary_lines(self, &new_last_line, &new_first_line)); =20 @@ -595,6 +618,19 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) first_line_changed =3D strcmp(new_first_line.text, self->first_line.text= ) !=3D 0; ASSERT_EQ(last_line_changed, first_line_changed); =20 + /* Check if PROCMAP_QUERY ioclt() finds the right VMA */ + ASSERT_TRUE(query_addr_at(self->maps_fd, mod_info->addr + self->page_siz= e, + &vma_start, &vma_end)); + /* + * The vma at the split address can be either the same as + * original one (if read before the split) or the same as the + * first line in the second page (if read after the split). + */ + ASSERT_TRUE((vma_start =3D=3D self->last_line.start_addr && + vma_end =3D=3D self->last_line.end_addr) || + (vma_start =3D=3D split_first_line.start_addr && + vma_end =3D=3D split_first_line.end_addr)); + clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose); } while (end_ts.tv_sec - start_ts.tv_sec < self->duration_sec); @@ -636,6 +672,9 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) clock_gettime(CLOCK_MONOTONIC_COARSE, &start_ts); start_test_loop(&start_ts, self->verbose); do { + unsigned long vma_start; + unsigned long vma_end; + ASSERT_TRUE(read_boundary_lines(self, &new_last_line, &new_first_line)); =20 /* Check if we read vmas after shrinking it */ @@ -662,6 +701,16 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) "Expand result invalid", self)); } =20 + /* Check if PROCMAP_QUERY ioclt() finds the right VMA */ + ASSERT_TRUE(query_addr_at(self->maps_fd, mod_info->addr, &vma_start, &vm= a_end)); + /* + * The vma should stay at the same address and have either the + * original size of 3 pages or 1 page if read after shrinking. + */ + ASSERT_TRUE(vma_start =3D=3D self->last_line.start_addr && + (vma_end - vma_start =3D=3D self->page_size * 3 || + vma_end - vma_start =3D=3D self->page_size)); + clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose); } while (end_ts.tv_sec - start_ts.tv_sec < self->duration_sec); @@ -703,6 +752,9 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) clock_gettime(CLOCK_MONOTONIC_COARSE, &start_ts); start_test_loop(&start_ts, self->verbose); do { + unsigned long vma_start; + unsigned long vma_end; + ASSERT_TRUE(read_boundary_lines(self, &new_last_line, &new_first_line)); =20 /* Check if we read vmas after remapping it */ @@ -729,6 +781,19 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) "Remap restore result invalid", self)); } =20 + /* Check if PROCMAP_QUERY ioclt() finds the right VMA */ + ASSERT_TRUE(query_addr_at(self->maps_fd, mod_info->addr + self->page_siz= e, + &vma_start, &vma_end)); + /* + * The vma should either stay at the same address and have the + * original size of 3 pages or we should find the remapped vma + * at the remap destination address with size of 1 page. + */ + ASSERT_TRUE((vma_start =3D=3D self->last_line.start_addr && + vma_end - vma_start =3D=3D self->page_size * 3) || + (vma_start =3D=3D self->last_line.start_addr + self->page_size && + vma_end - vma_start =3D=3D self->page_size)); + clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose); } while (end_ts.tv_sec - start_ts.tv_sec < self->duration_sec); --=20 2.50.1.703.g449372360f-goog From nobody Sun Oct 5 05:29:30 2025 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D1C5283FD3 for ; Fri, 8 Aug 2025 15:28:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754666940; cv=none; b=NNqekW7ikvvDFBfDj2AB8Qg0WdJcEoLZlMg2e1wQmRXLURO9KavuM2NsDNQH0+gN2rXpgNeDVkOEco37DHtxvNurb/UUXern0wTX+03rzhNRxdr+QhlKIh3qLL2egYM+ivfXv2suPvhPOQ4PI7vbUp9UUJlsi3oB4tVSo12Likw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754666940; c=relaxed/simple; bh=8OpkCmKw3cH6l8CeUegwMH8CJE9pwSj6mNLkROJG1EU=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=uQsQzqUCzfOxj+KZEptxWcH+KW3bUjsigv6WplmbU3Rq8a1zZgxdGRf890HJcw2qsDJ1H0ztNAlDH6IJeVlz86UjNNi1+2PdH+jvYiEEEZkZzWLZQbPCTcjq+RFlRu2D5NQm941BbhDcV46r4KZoYzDV+wi6UhyyQQ2bNMk2sdo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--surenb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=S/ZGTQ36; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--surenb.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="S/ZGTQ36" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2400499ab2fso19483575ad.0 for ; Fri, 08 Aug 2025 08:28:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1754666938; x=1755271738; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=oaaNxrFIYW8u5Zqt1umxh8jF3epFz2+2Ag+pI49sCxs=; b=S/ZGTQ36COb95MWDNuMPX0f3SboiluAtmYfellRrvJBfjVWDIybNe+/MigQ0/oBGJJ LHmLyCZl/+4925zY2Be73Ou5TDBDNH4wAE2Q+98a80uzQLu1lEWJ1j2gNeXTZMS2lc0l /qU3FIgGHvJMdRri7qmS1QsswIs5oCGxqlfc8O5ctzvlGIhdTTI2PzZmHN8EgWMpODLh FIM7/EgmaqBddsGy/L4V6iRfSkQd00EA/cyaC8r22gmYkBQOyKb4aDo7Z2/+SQHu/XiM Z5RjCXPD7UkW0Iz8xchkJf/E9+tKiwfOHW5oXokBBoCFDvQBBrZzkVB+qJjsIqHUMzE4 wbUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1754666938; x=1755271738; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=oaaNxrFIYW8u5Zqt1umxh8jF3epFz2+2Ag+pI49sCxs=; b=vEr3xnrzvi4qtdeRuCP0mS0pvfXlDQp40txNR107AamYnlSaAFsYIobuiLNiR10DQo ouDNcQENSGRtuilO9UXiaps8mk8w/Y0WEjUIL2FAzN/rfdLpzIlLQldoU31dBYjq3y0F SwV2ZuJxa/wNmaaXwiaIJeAh5VnaSKpqyH/XX3vrcI97hcJjTVgxT9PtJrx1Y+/HhC6I CMaOqTX9rCaK03AKNqPjd2H1j7rshW/39UVvpboHIETYzUKYn1LO16VNDcssEP9ZW9tX leKsHsYTEhfPnrxIsn/K3TvoF60p5eK9O8YSsJTep7BzzyQqDJ+/Poe8h2jmoHtIDZpC pN6Q== X-Forwarded-Encrypted: i=1; AJvYcCXQUe56NDBccd0ilMg/lXYXdoCFWmArk6cmcQ/omXkSS/R57i/vPYOO6fVS3ZX66D2Yv5jDcXE7iB2lQrU=@vger.kernel.org X-Gm-Message-State: AOJu0Yyur+RWjRkecKle8QJW7eWTskJIqlCQQcWIfrqQGF4ZMZXvGayn YX3eV4lpJpR9xX6G2Z7SyDXiWKUB9O91jTJFPKD/4+nIbNd9YM+ZY8nxCy/aqzbTXzN0g3dz5Av QBDR0Cw== X-Google-Smtp-Source: AGHT+IHE0hHtw1Xg0PUR8LXW1OvNYnxaIuDbWWkKp1lBoeFA09FI3YbrJczkDR7Cbe5a+Wuqw/7opjyJj9c= X-Received: from pjqs17.prod.google.com ([2002:a17:90a:ad91:b0:31e:eff2:4575]) (user=surenb job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:f64a:b0:240:3f39:2c73 with SMTP id d9443c01a7336-242c19ac4f0mr49253725ad.0.1754666937755; Fri, 08 Aug 2025 08:28:57 -0700 (PDT) Date: Fri, 8 Aug 2025 08:28:48 -0700 In-Reply-To: <20250808152850.2580887-1-surenb@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20250808152850.2580887-1-surenb@google.com> X-Mailer: git-send-email 2.50.1.703.g449372360f-goog Message-ID: <20250808152850.2580887-3-surenb@google.com> Subject: [PATCH v4 2/3] fs/proc/task_mmu: factor out proc_maps_private fields used by PROCMAP_QUERY From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: Liam.Howlett@oracle.com, lorenzo.stoakes@oracle.com, david@redhat.com, vbabka@suse.cz, peterx@redhat.com, jannh@google.com, hannes@cmpxchg.org, mhocko@kernel.org, paulmck@kernel.org, shuah@kernel.org, adobriyan@gmail.com, brauner@kernel.org, josef@toxicpanda.com, yebin10@huawei.com, linux@weissschuh.net, willy@infradead.org, osalvador@suse.de, andrii@kernel.org, ryan.roberts@arm.com, christophe.leroy@csgroup.eu, tjmercier@google.com, kaleshsingh@google.com, aha310510@gmail.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, surenb@google.com, SeongJae Park Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Refactor struct proc_maps_private so that the fields used by PROCMAP_QUERY ioctl are moved into a separate structure. In the next patch this allows ioctl to reuse some of the functions used for reading /proc/pid/maps without using file->private_data. This prevents concurrent modification of file->private_data members by ioctl and /proc/pid/maps readers. The change is pure code refactoring and has no functional changes. Signed-off-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Acked-by: SeongJae Park Reviewed-by: Lorenzo Stoakes --- fs/proc/internal.h | 15 +++++--- fs/proc/task_mmu.c | 87 +++++++++++++++++++++++--------------------- fs/proc/task_nommu.c | 14 +++---- 3 files changed, 63 insertions(+), 53 deletions(-) diff --git a/fs/proc/internal.h b/fs/proc/internal.h index e737401d7383..d1598576506c 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -378,16 +378,21 @@ extern void proc_self_init(void); * task_[no]mmu.c */ struct mem_size_stats; -struct proc_maps_private { - struct inode *inode; - struct task_struct *task; + +struct proc_maps_locking_ctx { struct mm_struct *mm; - struct vma_iterator iter; - loff_t last_pos; #ifdef CONFIG_PER_VMA_LOCK bool mmap_locked; struct vm_area_struct *locked_vma; #endif +}; + +struct proc_maps_private { + struct inode *inode; + struct task_struct *task; + struct vma_iterator iter; + loff_t last_pos; + struct proc_maps_locking_ctx lock_ctx; #ifdef CONFIG_NUMA struct mempolicy *task_mempolicy; #endif diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 29cca0e6d0ff..c0968d293b61 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -132,18 +132,18 @@ static void release_task_mempolicy(struct proc_maps_p= rivate *priv) =20 #ifdef CONFIG_PER_VMA_LOCK =20 -static void unlock_vma(struct proc_maps_private *priv) +static void unlock_ctx_vma(struct proc_maps_locking_ctx *lock_ctx) { - if (priv->locked_vma) { - vma_end_read(priv->locked_vma); - priv->locked_vma =3D NULL; + if (lock_ctx->locked_vma) { + vma_end_read(lock_ctx->locked_vma); + lock_ctx->locked_vma =3D NULL; } } =20 static const struct seq_operations proc_pid_maps_op; =20 static inline bool lock_vma_range(struct seq_file *m, - struct proc_maps_private *priv) + struct proc_maps_locking_ctx *lock_ctx) { /* * smaps and numa_maps perform page table walk, therefore require @@ -151,25 +151,25 @@ static inline bool lock_vma_range(struct seq_file *m, * walking the vma tree under rcu read protection. */ if (m->op !=3D &proc_pid_maps_op) { - if (mmap_read_lock_killable(priv->mm)) + if (mmap_read_lock_killable(lock_ctx->mm)) return false; =20 - priv->mmap_locked =3D true; + lock_ctx->mmap_locked =3D true; } else { rcu_read_lock(); - priv->locked_vma =3D NULL; - priv->mmap_locked =3D false; + lock_ctx->locked_vma =3D NULL; + lock_ctx->mmap_locked =3D false; } =20 return true; } =20 -static inline void unlock_vma_range(struct proc_maps_private *priv) +static inline void unlock_vma_range(struct proc_maps_locking_ctx *lock_ctx) { - if (priv->mmap_locked) { - mmap_read_unlock(priv->mm); + if (lock_ctx->mmap_locked) { + mmap_read_unlock(lock_ctx->mm); } else { - unlock_vma(priv); + unlock_ctx_vma(lock_ctx); rcu_read_unlock(); } } @@ -177,15 +177,16 @@ static inline void unlock_vma_range(struct proc_maps_= private *priv) static struct vm_area_struct *get_next_vma(struct proc_maps_private *priv, loff_t last_pos) { + struct proc_maps_locking_ctx *lock_ctx =3D &priv->lock_ctx; struct vm_area_struct *vma; =20 - if (priv->mmap_locked) + if (lock_ctx->mmap_locked) return vma_next(&priv->iter); =20 - unlock_vma(priv); - vma =3D lock_next_vma(priv->mm, &priv->iter, last_pos); + unlock_ctx_vma(lock_ctx); + vma =3D lock_next_vma(lock_ctx->mm, &priv->iter, last_pos); if (!IS_ERR_OR_NULL(vma)) - priv->locked_vma =3D vma; + lock_ctx->locked_vma =3D vma; =20 return vma; } @@ -193,14 +194,16 @@ static struct vm_area_struct *get_next_vma(struct pro= c_maps_private *priv, static inline bool fallback_to_mmap_lock(struct proc_maps_private *priv, loff_t pos) { - if (priv->mmap_locked) + struct proc_maps_locking_ctx *lock_ctx =3D &priv->lock_ctx; + + if (lock_ctx->mmap_locked) return false; =20 rcu_read_unlock(); - mmap_read_lock(priv->mm); + mmap_read_lock(lock_ctx->mm); /* Reinitialize the iterator after taking mmap_lock */ vma_iter_set(&priv->iter, pos); - priv->mmap_locked =3D true; + lock_ctx->mmap_locked =3D true; =20 return true; } @@ -208,14 +211,14 @@ static inline bool fallback_to_mmap_lock(struct proc_= maps_private *priv, #else /* CONFIG_PER_VMA_LOCK */ =20 static inline bool lock_vma_range(struct seq_file *m, - struct proc_maps_private *priv) + struct proc_maps_locking_ctx *lock_ctx) { - return mmap_read_lock_killable(priv->mm) =3D=3D 0; + return mmap_read_lock_killable(lock_ctx->mm) =3D=3D 0; } =20 -static inline void unlock_vma_range(struct proc_maps_private *priv) +static inline void unlock_vma_range(struct proc_maps_locking_ctx *lock_ctx) { - mmap_read_unlock(priv->mm); + mmap_read_unlock(lock_ctx->mm); } =20 static struct vm_area_struct *get_next_vma(struct proc_maps_private *priv, @@ -258,7 +261,7 @@ static struct vm_area_struct *proc_get_vma(struct seq_f= ile *m, loff_t *ppos) *ppos =3D vma->vm_end; } else { *ppos =3D SENTINEL_VMA_GATE; - vma =3D get_gate_vma(priv->mm); + vma =3D get_gate_vma(priv->lock_ctx.mm); } =20 return vma; @@ -267,6 +270,7 @@ static struct vm_area_struct *proc_get_vma(struct seq_f= ile *m, loff_t *ppos) static void *m_start(struct seq_file *m, loff_t *ppos) { struct proc_maps_private *priv =3D m->private; + struct proc_maps_locking_ctx *lock_ctx; loff_t last_addr =3D *ppos; struct mm_struct *mm; =20 @@ -278,14 +282,15 @@ static void *m_start(struct seq_file *m, loff_t *ppos) if (!priv->task) return ERR_PTR(-ESRCH); =20 - mm =3D priv->mm; + lock_ctx =3D &priv->lock_ctx; + mm =3D lock_ctx->mm; if (!mm || !mmget_not_zero(mm)) { put_task_struct(priv->task); priv->task =3D NULL; return NULL; } =20 - if (!lock_vma_range(m, priv)) { + if (!lock_vma_range(m, lock_ctx)) { mmput(mm); put_task_struct(priv->task); priv->task =3D NULL; @@ -318,13 +323,13 @@ static void *m_next(struct seq_file *m, void *v, loff= _t *ppos) static void m_stop(struct seq_file *m, void *v) { struct proc_maps_private *priv =3D m->private; - struct mm_struct *mm =3D priv->mm; + struct mm_struct *mm =3D priv->lock_ctx.mm; =20 if (!priv->task) return; =20 release_task_mempolicy(priv); - unlock_vma_range(priv); + unlock_vma_range(&priv->lock_ctx); mmput(mm); put_task_struct(priv->task); priv->task =3D NULL; @@ -339,9 +344,9 @@ static int proc_maps_open(struct inode *inode, struct f= ile *file, return -ENOMEM; =20 priv->inode =3D inode; - priv->mm =3D proc_mem_open(inode, PTRACE_MODE_READ); - if (IS_ERR(priv->mm)) { - int err =3D PTR_ERR(priv->mm); + priv->lock_ctx.mm =3D proc_mem_open(inode, PTRACE_MODE_READ); + if (IS_ERR(priv->lock_ctx.mm)) { + int err =3D PTR_ERR(priv->lock_ctx.mm); =20 seq_release_private(inode, file); return err; @@ -355,8 +360,8 @@ static int proc_map_release(struct inode *inode, struct= file *file) struct seq_file *seq =3D file->private_data; struct proc_maps_private *priv =3D seq->private; =20 - if (priv->mm) - mmdrop(priv->mm); + if (priv->lock_ctx.mm) + mmdrop(priv->lock_ctx.mm); =20 return seq_release_private(inode, file); } @@ -610,7 +615,7 @@ static int do_procmap_query(struct proc_maps_private *p= riv, void __user *uarg) if (!!karg.build_id_size !=3D !!karg.build_id_addr) return -EINVAL; =20 - mm =3D priv->mm; + mm =3D priv->lock_ctx.mm; if (!mm || !mmget_not_zero(mm)) return -ESRCH; =20 @@ -1311,7 +1316,7 @@ static int show_smaps_rollup(struct seq_file *m, void= *v) { struct proc_maps_private *priv =3D m->private; struct mem_size_stats mss =3D {}; - struct mm_struct *mm =3D priv->mm; + struct mm_struct *mm =3D priv->lock_ctx.mm; struct vm_area_struct *vma; unsigned long vma_start =3D 0, last_vma_end =3D 0; int ret =3D 0; @@ -1456,9 +1461,9 @@ static int smaps_rollup_open(struct inode *inode, str= uct file *file) goto out_free; =20 priv->inode =3D inode; - priv->mm =3D proc_mem_open(inode, PTRACE_MODE_READ); - if (IS_ERR_OR_NULL(priv->mm)) { - ret =3D priv->mm ? PTR_ERR(priv->mm) : -ESRCH; + priv->lock_ctx.mm =3D proc_mem_open(inode, PTRACE_MODE_READ); + if (IS_ERR_OR_NULL(priv->lock_ctx.mm)) { + ret =3D priv->lock_ctx.mm ? PTR_ERR(priv->lock_ctx.mm) : -ESRCH; =20 single_release(inode, file); goto out_free; @@ -1476,8 +1481,8 @@ static int smaps_rollup_release(struct inode *inode, = struct file *file) struct seq_file *seq =3D file->private_data; struct proc_maps_private *priv =3D seq->private; =20 - if (priv->mm) - mmdrop(priv->mm); + if (priv->lock_ctx.mm) + mmdrop(priv->lock_ctx.mm); =20 kfree(priv); return single_release(inode, file); diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c index 59bfd61d653a..d362919f4f68 100644 --- a/fs/proc/task_nommu.c +++ b/fs/proc/task_nommu.c @@ -204,7 +204,7 @@ static void *m_start(struct seq_file *m, loff_t *ppos) if (!priv->task) return ERR_PTR(-ESRCH); =20 - mm =3D priv->mm; + mm =3D priv->lock_ctx.mm; if (!mm || !mmget_not_zero(mm)) { put_task_struct(priv->task); priv->task =3D NULL; @@ -226,7 +226,7 @@ static void *m_start(struct seq_file *m, loff_t *ppos) static void m_stop(struct seq_file *m, void *v) { struct proc_maps_private *priv =3D m->private; - struct mm_struct *mm =3D priv->mm; + struct mm_struct *mm =3D priv->lock_ctx.mm; =20 if (!priv->task) return; @@ -259,9 +259,9 @@ static int maps_open(struct inode *inode, struct file *= file, return -ENOMEM; =20 priv->inode =3D inode; - priv->mm =3D proc_mem_open(inode, PTRACE_MODE_READ); - if (IS_ERR_OR_NULL(priv->mm)) { - int err =3D priv->mm ? PTR_ERR(priv->mm) : -ESRCH; + priv->lock_ctx.mm =3D proc_mem_open(inode, PTRACE_MODE_READ); + if (IS_ERR_OR_NULL(priv->lock_ctx.mm)) { + int err =3D priv->lock_ctx.mm ? PTR_ERR(priv->lock_ctx.mm) : -ESRCH; =20 seq_release_private(inode, file); return err; @@ -276,8 +276,8 @@ static int map_release(struct inode *inode, struct file= *file) struct seq_file *seq =3D file->private_data; struct proc_maps_private *priv =3D seq->private; =20 - if (priv->mm) - mmdrop(priv->mm); + if (priv->lock_ctx.mm) + mmdrop(priv->lock_ctx.mm); =20 return seq_release_private(inode, file); } --=20 2.50.1.703.g449372360f-goog From nobody Sun Oct 5 05:29:30 2025 Received: from mail-pj1-f74.google.com (mail-pj1-f74.google.com [209.85.216.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8A24328469B for ; Fri, 8 Aug 2025 15:29:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754666942; cv=none; b=GhVOGwECUucmMy8mn4v6/YJ008UXYUEdbwAblU0hKFTG+tHAGX8WqCSdWIG5+sdcfyyfZEoAo9UB9KSNKvFKva1Nl30cf6nClSRmva5th0tbwVYJoeEBhDmrkpRpRiHmRW/ehVSbgaccs2leUYjjM5bn5CZS8g6IzaWhitUUubY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754666942; c=relaxed/simple; bh=d6ZyZjRCfzLf7EHML4v3fFLKZt6TIu0nk5DduaNsAP8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=mukSyvml5+2bG0t87M2sNgQdkfIGQfCth/l2TUuR9YEybUXXl1QoYSaDa71v9uT+2IrSkTyb5yrHhIVZXaTf79BZiuI2tgaNvxc6oa7hYMpI5nuKMatMeVDYNAk5zdgdROxXzn8amc23y3YYU+FCflJY6U66jVCKizUbdVQ2KMY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--surenb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=nek0R3GR; arc=none smtp.client-ip=209.85.216.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--surenb.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nek0R3GR" Received: by mail-pj1-f74.google.com with SMTP id 98e67ed59e1d1-31eec17b5acso2707197a91.2 for ; Fri, 08 Aug 2025 08:29:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1754666940; x=1755271740; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=5qaVRp5+Q87psp1cSnwtcdG7GaGDDk1FPXSJsj5vDHc=; b=nek0R3GRGl+XTG3LISeIeaSdEiuQzdP73a1OZPhGjJP3QWGubiIOAzxCWJ7o2QUSsI v2zkPYqMONnD6mhu8v/VG9/e2C+Jj2edtRxfYSAWhdTwIfpDbbRImZC5W5r6jFT5C1PN 666Hx8aA61APQXhpdc4eQoV21S63bSUSeUGEpl8HCwoBr0IgzWwq5HZjOEN4PwpWEXHO JBCTuQh1SATJid9ZKgyu3Pkct08giNSKbe2ov1g1XE7lg6D5Y4zsM3BlMCvmQxO9Xpak OqsevdcRUxpcNFupW9UFEuinOImufn7TCHJruOe2GlCcHEGWHNWmvUFlEaessqD9xD7/ DVCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1754666940; x=1755271740; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=5qaVRp5+Q87psp1cSnwtcdG7GaGDDk1FPXSJsj5vDHc=; b=i0xMZ7ZRjvQFWBAvKqRv9pHuIc7n1BK+Dmj2auZvExOVyoMXHSAqkNsYm2EvXFIxRx 1dl5uiPl2VYVKfRNXF++5/F2NwUftWLDXpA8zCeYGcjk+Lgl+Z7/1C3BagrH0YClLI7n XAlyut6QzyCzvMeguCS538xKlyBWHdb39nxpPcirSCvreV8KQAw5+WD/087YIBBnwrXN wRmh9rlQ4KdqJQCqkVXHRT8m+B8dZHk/93cItf6ck8IfoXlzYXQMjC/EyvEgPsQgefHk LqiMX1O5fDAbvlpulN40pS2Ue+zs3GR0rEH5xuvnriCxBi7Ylknx9gLROZHhRoIIi5rf DX7A== X-Forwarded-Encrypted: i=1; AJvYcCX38INfuYLOzEZc6CYm+KkU3YRrhr+awd+vAcOvaWuiJemsk3EmhipDB++LxtPh849lBMUZPINNNCIzOiY=@vger.kernel.org X-Gm-Message-State: AOJu0Yx7lUJJEqRcB4N7LOGTJQ5Cc9h7I2TW2XECWAslrQnrutqB942e V32ZlMLdx/CnjNR/YLoiAjS0xHSzpq5AS+x89x2iaBBI5HUGb5wd+5aj5hk9/CH8VoAXNLX/XjA XbpZ0kA== X-Google-Smtp-Source: AGHT+IGfHbSuaYkDvkzFDZll/OyuLjbjmWu+3tdj38KsO6i2Mr+NdU7aQQPpEiVzAfcHA2GS7b/edCdIm5g= X-Received: from pjboe9.prod.google.com ([2002:a17:90b:3949:b0:321:9285:be8]) (user=surenb job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:3e4b:b0:316:3972:b9d0 with SMTP id 98e67ed59e1d1-321838a7672mr5733158a91.0.1754666939750; Fri, 08 Aug 2025 08:28:59 -0700 (PDT) Date: Fri, 8 Aug 2025 08:28:49 -0700 In-Reply-To: <20250808152850.2580887-1-surenb@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20250808152850.2580887-1-surenb@google.com> X-Mailer: git-send-email 2.50.1.703.g449372360f-goog Message-ID: <20250808152850.2580887-4-surenb@google.com> Subject: [PATCH v4 3/3] fs/proc/task_mmu: execute PROCMAP_QUERY ioctl under per-vma locks From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: Liam.Howlett@oracle.com, lorenzo.stoakes@oracle.com, david@redhat.com, vbabka@suse.cz, peterx@redhat.com, jannh@google.com, hannes@cmpxchg.org, mhocko@kernel.org, paulmck@kernel.org, shuah@kernel.org, adobriyan@gmail.com, brauner@kernel.org, josef@toxicpanda.com, yebin10@huawei.com, linux@weissschuh.net, willy@infradead.org, osalvador@suse.de, andrii@kernel.org, ryan.roberts@arm.com, christophe.leroy@csgroup.eu, tjmercier@google.com, kaleshsingh@google.com, aha310510@gmail.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, surenb@google.com, SeongJae Park Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Utilize per-vma locks to stabilize vma after lookup without taking mmap_lock during PROCMAP_QUERY ioctl execution. If vma lock is contended, we fall back to mmap_lock but take it only momentarily to lock the vma and release the mmap_lock. In a very unlikely case of vm_refcnt overflow, this fall back path will fail and ioctl is done under mmap_lock protection. This change is designed to reduce mmap_lock contention and prevent PROCMAP_QUERY ioctl calls from blocking address space updates. Signed-off-by: Suren Baghdasaryan Acked-by: SeongJae Park Acked-by: Andrii Nakryiko Reviewed-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka --- fs/proc/task_mmu.c | 103 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 85 insertions(+), 18 deletions(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index c0968d293b61..e64cf40ce9c4 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -132,6 +132,12 @@ static void release_task_mempolicy(struct proc_maps_pr= ivate *priv) =20 #ifdef CONFIG_PER_VMA_LOCK =20 +static void reset_lock_ctx(struct proc_maps_locking_ctx *lock_ctx) +{ + lock_ctx->locked_vma =3D NULL; + lock_ctx->mmap_locked =3D false; +} + static void unlock_ctx_vma(struct proc_maps_locking_ctx *lock_ctx) { if (lock_ctx->locked_vma) { @@ -157,8 +163,7 @@ static inline bool lock_vma_range(struct seq_file *m, lock_ctx->mmap_locked =3D true; } else { rcu_read_lock(); - lock_ctx->locked_vma =3D NULL; - lock_ctx->mmap_locked =3D false; + reset_lock_ctx(lock_ctx); } =20 return true; @@ -522,28 +527,90 @@ static int pid_maps_open(struct inode *inode, struct = file *file) PROCMAP_QUERY_VMA_FLAGS \ ) =20 -static int query_vma_setup(struct mm_struct *mm) +#ifdef CONFIG_PER_VMA_LOCK + +static int query_vma_setup(struct proc_maps_locking_ctx *lock_ctx) { - return mmap_read_lock_killable(mm); + reset_lock_ctx(lock_ctx); + + return 0; } =20 -static void query_vma_teardown(struct mm_struct *mm, struct vm_area_struct= *vma) +static void query_vma_teardown(struct proc_maps_locking_ctx *lock_ctx) { - mmap_read_unlock(mm); + if (lock_ctx->mmap_locked) { + mmap_read_unlock(lock_ctx->mm); + lock_ctx->mmap_locked =3D false; + } else { + unlock_ctx_vma(lock_ctx); + } +} + +static struct vm_area_struct *query_vma_find_by_addr(struct proc_maps_lock= ing_ctx *lock_ctx, + unsigned long addr) +{ + struct mm_struct *mm =3D lock_ctx->mm; + struct vm_area_struct *vma; + struct vma_iterator vmi; + + if (lock_ctx->mmap_locked) + return find_vma(mm, addr); + + /* Unlock previously locked VMA and find the next one under RCU */ + unlock_ctx_vma(lock_ctx); + rcu_read_lock(); + vma_iter_init(&vmi, mm, addr); + vma =3D lock_next_vma(mm, &vmi, addr); + rcu_read_unlock(); + + if (!vma) + return NULL; + + if (!IS_ERR(vma)) { + lock_ctx->locked_vma =3D vma; + return vma; + } + + if (PTR_ERR(vma) =3D=3D -EAGAIN) { + /* Fallback to mmap_lock on vma->vm_refcnt overflow */ + mmap_read_lock(mm); + vma =3D find_vma(mm, addr); + lock_ctx->mmap_locked =3D true; + } + + return vma; } =20 -static struct vm_area_struct *query_vma_find_by_addr(struct mm_struct *mm,= unsigned long addr) +#else /* CONFIG_PER_VMA_LOCK */ + +static int query_vma_setup(struct proc_maps_locking_ctx *lock_ctx) +{ + return mmap_read_lock_killable(lock_ctx->mm); +} + +static void query_vma_teardown(struct proc_maps_locking_ctx *lock_ctx) +{ + mmap_read_unlock(lock_ctx->mm); +} + +static struct vm_area_struct *query_vma_find_by_addr(struct proc_maps_lock= ing_ctx *lock_ctx, + unsigned long addr) { - return find_vma(mm, addr); + return find_vma(lock_ctx->mm, addr); } =20 -static struct vm_area_struct *query_matching_vma(struct mm_struct *mm, +#endif /* CONFIG_PER_VMA_LOCK */ + +static struct vm_area_struct *query_matching_vma(struct proc_maps_locking_= ctx *lock_ctx, unsigned long addr, u32 flags) { struct vm_area_struct *vma; =20 next_vma: - vma =3D query_vma_find_by_addr(mm, addr); + vma =3D query_vma_find_by_addr(lock_ctx, addr); + if (IS_ERR(vma)) + return vma; + if (!vma) goto no_vma; =20 @@ -584,11 +651,11 @@ static struct vm_area_struct *query_matching_vma(stru= ct mm_struct *mm, return ERR_PTR(-ENOENT); } =20 -static int do_procmap_query(struct proc_maps_private *priv, void __user *u= arg) +static int do_procmap_query(struct mm_struct *mm, void __user *uarg) { + struct proc_maps_locking_ctx lock_ctx =3D { .mm =3D mm }; struct procmap_query karg; struct vm_area_struct *vma; - struct mm_struct *mm; const char *name =3D NULL; char build_id_buf[BUILD_ID_SIZE_MAX], *name_buf =3D NULL; __u64 usize; @@ -615,17 +682,16 @@ static int do_procmap_query(struct proc_maps_private = *priv, void __user *uarg) if (!!karg.build_id_size !=3D !!karg.build_id_addr) return -EINVAL; =20 - mm =3D priv->lock_ctx.mm; if (!mm || !mmget_not_zero(mm)) return -ESRCH; =20 - err =3D query_vma_setup(mm); + err =3D query_vma_setup(&lock_ctx); if (err) { mmput(mm); return err; } =20 - vma =3D query_matching_vma(mm, karg.query_addr, karg.query_flags); + vma =3D query_matching_vma(&lock_ctx, karg.query_addr, karg.query_flags); if (IS_ERR(vma)) { err =3D PTR_ERR(vma); vma =3D NULL; @@ -710,7 +776,7 @@ static int do_procmap_query(struct proc_maps_private *p= riv, void __user *uarg) } =20 /* unlock vma or mmap_lock, and put mm_struct before copying data to user= */ - query_vma_teardown(mm, vma); + query_vma_teardown(&lock_ctx); mmput(mm); =20 if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr= ), @@ -730,7 +796,7 @@ static int do_procmap_query(struct proc_maps_private *p= riv, void __user *uarg) return 0; =20 out: - query_vma_teardown(mm, vma); + query_vma_teardown(&lock_ctx); mmput(mm); kfree(name_buf); return err; @@ -743,7 +809,8 @@ static long procfs_procmap_ioctl(struct file *file, uns= igned int cmd, unsigned l =20 switch (cmd) { case PROCMAP_QUERY: - return do_procmap_query(priv, (void __user *)arg); + /* priv->lock_ctx.mm is set during file open operation */ + return do_procmap_query(priv->lock_ctx.mm, (void __user *)arg); default: return -ENOIOCTLCMD; } --=20 2.50.1.703.g449372360f-goog