Re: [PATCH stable 4.4 v2] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping

[Jason Gunthorpe]

On Mon, Jun 10, 2019 at 03:58:23PM +0200, Michal Hocko wrote:
> Just a heads up. Ajay Kaher has noticed that mlx4 driver is missing the
> check in 4.14 [1] and 4.4 seems to have the same problem. I will wait
> for more review before reposting v3. The incremental diff is:
> 
> diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
> index 67c4c73343d4..6968154a073e 100644
> +++ b/drivers/infiniband/hw/mlx4/main.c
> @@ -1042,6 +1042,8 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
>  	 * mlx4_ib_vma_close().
>  	 */
>  	down_write(&owning_mm->mmap_sem);
> +	if (!mmget_still_valid(owning_mm))
> +		goto skip_mm;
>  	for (i = 0; i < HW_BAR_COUNT; i++) {
>  		vma = context->hw_bar_info[i].vma;
>  		if (!vma)
> @@ -1061,6 +1063,7 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
>  		context->hw_bar_info[i].vma->vm_ops = NULL;
>  	}
>  
> +skip_mm:
>  	up_write(&owning_mm->mmap_sem);
>  	mmput(owning_mm);
>  	put_task_struct(owning_process);

Looks OK to me

Jason