Here's how I understand mm refcounts:
funcs | counter | manages lifecycle of... -------------------------------------------------------- mmgrab()/mmdrop() | mm_count | mm_struct and PGD -------------------------------------------------------- mmget()/mmput() | mm_users | userspace address space
All mm_users references share a single reference to the mm_struct.
mm_alloc() returns the mm with a single reference to the user address space, i.e. with mm_users=1, mm_count=1.
kunit_attach_mm() then passes the mm to kthread_use_mm(). It does not call kthread_unuse_mm(), instead it relies on the kthread exit path to release the relevant resources. It does this because KUnit's resource cleanup logic works by running cleanups in a different kthread from the test. You can't have cleanups that operate on the kthread, because the kthread is already gone by the time the cleanup is called.
The kthread exit path will indeed drop the reference to the address space, i.e. it will call mmput(task->mm), decrementing mm_users. However, it does not release the reference taken on the mm_struct when kthread_use_mm() called mmgrab().
To fix this, use the new kthread_take_mm() which provides the API KUnit needs.
Signed-off-by: Brendan Jackman jackmanb@google.com --- lib/kunit/user_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/kunit/user_alloc.c b/lib/kunit/user_alloc.c index 564f5566641d5..3fca4ae223f67 100644 --- a/lib/kunit/user_alloc.c +++ b/lib/kunit/user_alloc.c @@ -29,7 +29,7 @@ int kunit_attach_mm(void) arch_pick_mmap_layout(mm, ¤t->signal->rlim[RLIMIT_STACK]);
/* Attach the mm. It will be cleaned up when the process dies. */ - kthread_use_mm(mm); + kthread_take_mm(mm);
return 0; }