[openib-general] [PATCH][uverbs] use get_task_mm

[Michael S. Tsirkin]

The task mm may go away while umem_get is in progress.
Semaphore access will then crash. Use get_task_mm to prevent this.

Signed-off-by: Michael S. Tsirkin <mst at mellanox.co.il>

Index: core/uverbs_mem.c
===================================================================
--- core/uverbs_mem.c	(revision 1922)
+++ core/uverbs_mem.c	(working copy)
@@ -47,11 +47,16 @@ int ib_umem_get(struct ib_device *dev, s
 	int ret = 0;
 	int off;
 	int i;
+	struct mm_struct * mm;
 
 	page_list = (struct page **) __get_free_page(GFP_KERNEL);
 	if (!page_list)
 		return -ENOMEM;
 
+	mm = get_task_mm(current);
+	if (!mm)
+		return -EINTR;
+
 	mem->length    = size;
 	mem->offset    = (unsigned long) addr & ~PAGE_MASK;
 	mem->page_size = PAGE_SIZE;
@@ -61,10 +66,10 @@ int ib_umem_get(struct ib_device *dev, s
 	npages   = PAGE_ALIGN(size + mem->offset) >> PAGE_SHIFT;
 	cur_base = (unsigned long) addr & PAGE_MASK;
 
-	down_read(&current->mm->mmap_sem);
+	down_read(&mm->mmap_sem);
 
 	while (npages) {
-		ret = get_user_pages(current, current->mm, cur_base,
+		ret = get_user_pages(current, mm, cur_base,
 				     min_t(int, npages,
 					   PAGE_SIZE / sizeof (struct page *)),
 				     1, 0, page_list, NULL);
@@ -120,7 +125,8 @@ int ib_umem_get(struct ib_device *dev, s
 	}
 
 out:
-	up_read(&current->mm->mmap_sem);
+	up_read(&mm->mmap_sem);
+	mmput(mm);
 	free_page((unsigned long) page_list);
 
 	if (ret < 0)

-- 
MST - Michael S. Tsirkin