brk might be used to shinrk memory mapping too. Use __do_munmap() to shrink mapping with downgrading mmap_sem to read.
Cc: Michal Hocko <[email protected]> Cc: Kirill A. Shutemov <[email protected]> Cc: Matthew Wilcox <[email protected]> Cc: Laurent Dufour <[email protected]> Cc: Vlastimil Babka <[email protected]> Cc: Andrew Morton <[email protected]> Signed-off-by: Yang Shi <[email protected]> --- mm/mmap.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 017bcfa..3da14a1 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -193,9 +193,11 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long unsigned long retval; unsigned long newbrk, oldbrk; struct mm_struct *mm = current->mm; + unsigned long origbrk = mm->brk; struct vm_area_struct *next; unsigned long min_brk; bool populate; + bool downgrade = false; LIST_HEAD(uf); if (down_write_killable(&mm->mmap_sem)) @@ -229,14 +231,26 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long newbrk = PAGE_ALIGN(brk); oldbrk = PAGE_ALIGN(mm->brk); - if (oldbrk == newbrk) - goto set_brk; + if (oldbrk == newbrk) { + mm->brk = brk; + goto success; + } /* Always allow shrinking brk. */ if (brk <= mm->brk) { - if (!do_munmap(mm, newbrk, oldbrk-newbrk, &uf)) - goto set_brk; - goto out; + /* + * mm->brk need to be protected by write mmap_sem, update it + * before downgrading mmap_sem. + * When __do_munmap fail, it will be restored from origbrk. + */ + mm->brk = brk; + retval = __do_munmap(mm, newbrk, oldbrk-newbrk, &uf, true); + if (retval < 0) { + mm->brk = origbrk; + goto out; + } else if (retval == 1) + downgrade = true; + goto success; } /* Check against existing mmap mappings. */ @@ -247,18 +261,21 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long /* Ok, looks good - let it rip. */ if (do_brk_flags(oldbrk, newbrk-oldbrk, 0, &uf) < 0) goto out; - -set_brk: mm->brk = brk; + +success: populate = newbrk > oldbrk && (mm->def_flags & VM_LOCKED) != 0; - up_write(&mm->mmap_sem); + if (downgrade) + up_read(&mm->mmap_sem); + else + up_write(&mm->mmap_sem); userfaultfd_unmap_complete(mm, &uf); if (populate) mm_populate(oldbrk, newbrk - oldbrk); return brk; out: - retval = mm->brk; + retval = origbrk; up_write(&mm->mmap_sem); return retval; } -- 1.8.3.1
