mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts
mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts

There is a race condition between mmu_notifier_unregister() and
__mmu_notifier_release().

Assume two tasks, one calling mmu_notifier_unregister() as a result of a
filp_close() ->flush() callout (task A), and the other calling
mmu_notifier_release() from an mmput() (task B).

                A                               B
t1                                              srcu_read_lock()
t2              if (!hlist_unhashed())
t3                                              srcu_read_unlock()
t4              srcu_read_lock()
t5                                              hlist_del_init_rcu()
t6                                              synchronize_srcu()
t7              srcu_read_unlock()
t8              hlist_del_rcu()  <--- NULL pointer deref.

Additionally, the list traversal in __mmu_notifier_release() is not
protected by the by the mmu_notifier_mm->hlist_lock which can result in
callouts to the ->release() notifier from both mmu_notifier_unregister()
and __mmu_notifier_release().

-stable suggestions:

The stable trees prior to 3.7.y need commits 21a92735f660 and
70400303ce0c cherry-picked in that order prior to cherry-picking this
commit.  The 3.7.y tree already has those two commits.

Signed-off-by: Robin Holt <fad267d8332d5f62140cfd0120e54d2a812d419e@sgi.com>
Cc: Andrea Arcangeli <6cb163d975a8c4c46420677e0054b55c39bdb339@redhat.com>
Cc: Wanpeng Li <86d530c4a0b810dc887df1e4e084ed44c9b7acac@linux.vnet.ibm.com>
Cc: Xiao Guangrong <1e0036c3819c78880ef9e9a8457e99783a5661e3@linux.vnet.ibm.com>
Cc: Avi Kivity <8f920f22884d6fea9df883843c4a8095a2e5ac6f@redhat.com>
Cc: Hugh Dickins <d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com>
Cc: Marcelo Tosatti <958bcd1f4a7a8c36dca09fe3fa9cb5f1483adf51@redhat.com>
Cc: Sagi Grimberg <380ce2a82d3d08e67ab163b51dc6d30288ad3f13@mellanox.co.il>
Cc: Haggai Eran <a558c0e8c8d9df6f2e5864bc715329bac6a2f11b@mellanox.com>
Cc: <4fbacc2fa0ffdbb11bf1ad6925b886ebd08dd15f@vger.kernel.org>
Signed-off-by: Andrew Morton <5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org>
Signed-off-by: Linus Torvalds <69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org>

KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas