Skip to content
  • Mike Rapoport's avatar
    userfaultfd: prevent non-cooperative events vs mcopy_atomic races · df2cc96e
    Mike Rapoport authored
    If a process monitored with userfaultfd changes it's memory mappings or
    forks() at the same time as uffd monitor fills the process memory with
    UFFDIO_COPY, the actual creation of page table entries and copying of
    the data in mcopy_atomic may happen either before of after the memory
    mapping modifications and there is no way for the uffd monitor to
    maintain consistent view of the process memory layout.
    
    For instance, let's consider fork() running in parallel with
    userfaultfd_copy():
    
    process        		         |	uffd monitor
    ---------------------------------+------------------------------
    fork()        		         | userfaultfd_copy()
    ...        		         | ...
        dup_mmap()        	         |     down_read(mmap_sem)
        down_write(mmap_sem)         |     /* create PTEs, copy data */
            dup_uffd()               |     up_read(mmap_sem)
            copy_page_range()        |
            up_write(mmap_sem)       |
            dup_uffd_complete()      |...
    df2cc96e