Re: [PATCH bpf-next v9 1/5] mm: Add copy_remote_mm_str()

[bot+bpf-ci@kernel.org]

[-- Attachment #1: Type: text/plain, Size: 2183 bytes --]

> diff --git a/mm/util.c b/mm/util.c
> index bf0513d1d3d08..75c0fc2061aa0 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -1061,6 +1061,66 @@ int get_cmdline(struct task_struct *task, char *buffer, int buflen)
>  	return res;
>  }
>
> +/**
> + * copy_remote_mm_str - copy a string from a remote address space.
> + * @mm:         the remote address space
> + * @addr:       start address to read from
> + * @buf:        destination buffer
> + * @len:        number of bytes to copy
> + * @gup_flags:  flags modifying lookup behaviour
> + *
> + * The caller must hold a reference on @mm.
> + *
> + * Return: number of bytes copied from @addr (source) to @buf (destination),
> + * not including the trailing NUL. If @len is zero, return 0 without accessing
> + * @buf. Otherwise, @buf is always NUL-terminated. On any error, return
> + * -EFAULT.
> + */
> +int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr,
> +		void *buf, int len, unsigned int gup_flags)
> +{
> +	if (unlikely(len == 0))
> +		return 0;
> +
> +	return __copy_remote_mm_str(mm, addr, buf, len, gup_flags);
> +}

The documentation says "The caller must hold a reference on @mm" but
doesn't specify which reference count. Should this clarify that the
caller needs an mm_users reference (mmget/mmget_not_zero) rather than
just mm_count (mmgrab)?

The implementation takes mmap_read_lock_killable(mm) and accesses the
address space through vma_lookup() and get_user_page_vma_remote() in
__copy_remote_mm_str():

mm/memory.c:__copy_remote_mm_str() {
    ...
    if (mmap_read_lock_killable(mm))
        return -EFAULT;

    addr = untagged_addr_remote(mm, addr);
    ...
    while (len) {
        ...
        vma = vma_lookup(mm, addr);
        ...
        ret = get_user_page_vma_remote(mm, addr, gup_flags, &page, &vma);
        ...
    }
    ...
}

An mmgrab()-only caller would race with address space teardown in
__mmput()->exit_mmap() once mm_users reaches zero.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/35351393336