From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E257C54F30 for ; Tue, 27 May 2025 13:40:03 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A3C416B00A1; Tue, 27 May 2025 09:40:02 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 99E546B00A2; Tue, 27 May 2025 09:40:02 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 88D3F6B00A3; Tue, 27 May 2025 09:40:02 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 6A27C6B00A1 for ; Tue, 27 May 2025 09:40:02 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 15987BD562 for ; Tue, 27 May 2025 13:40:02 +0000 (UTC) X-FDA: 83488796244.30.6368781 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) by imf04.hostedemail.com (Postfix) with ESMTP id D1C2540003 for ; Tue, 27 May 2025 13:39:58 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=none; spf=none (imf04.hostedemail.com: domain of pulehui@huaweicloud.com has no SPF policy when checking 45.249.212.51) smtp.mailfrom=pulehui@huaweicloud.com; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1748353200; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3zxrKZPAMG0kDL1y8s7pruZ8GKrD0mE3OyY1LiuoIXg=; b=19QeZxLIx73UdbkJbT+FA2oezpE2UjtHSFGDWmUBcxo1XHQs5oSbWbPMVQGUx4u0UyU4YR z6kM2j4JNelobOPzOq0g54vor45eQ6DG8JHraEYOEgRwdVnhZST4EqUdm7K51kTXOEIIQg xVMKNt5qEob2uv4Xf9mto6mJEJCnIGQ= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=none; spf=none (imf04.hostedemail.com: domain of pulehui@huaweicloud.com has no SPF policy when checking 45.249.212.51) smtp.mailfrom=pulehui@huaweicloud.com; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1748353200; a=rsa-sha256; cv=none; b=OVNIASjLunptQYMOYThuatcKDuoTrM0d4jYvkkSFxeAd8/MH8rCcY8tprOFpOWvcS+3EKn aqOBJDZTj27rs9N5z3TBCBdxg3wSdOBdxV+rSx3KL845jUPDKhe1OwjDPraj1YviajWNu1 VL7RMkJEU0oKwiOmaHFVKoNyNJzjeaA= Received: from mail.maildlp.com (unknown [172.19.93.142]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4b6DJr5NpczYQv52 for ; Tue, 27 May 2025 21:39:56 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id DB1B41A07BB for ; Tue, 27 May 2025 21:39:55 +0800 (CST) Received: from [10.67.109.184] (unknown [10.67.109.184]) by APP4 (Coremail) with SMTP id gCh0CgBXBlurwDVovl+2Ng--.5058S2; Tue, 27 May 2025 21:39:55 +0800 (CST) Message-ID: <03b171c9-0de2-4d25-9d12-6d49d4daa2b5@huaweicloud.com> Date: Tue, 27 May 2025 21:39:55 +0800 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [RFC PATCH] mm/mmap: Fix uprobe anon page be overwritten when expanding vma during mremap Content-Language: en-US To: Lorenzo Stoakes , David Hildenbrand Cc: Oleg Nesterov , mhiramat@kernel.org, peterz@infradead.org, Liam.Howlett@oracle.com, akpm@linux-foundation.org, vbabka@suse.cz, jannh@google.com, pfalcato@suse.de, linux-mm@kvack.org, linux-kernel@vger.kernel.org, pulehui@huawei.com References: <20250521092503.3116340-1-pulehui@huaweicloud.com> <62b5ccf5-f1cd-43c2-b0bc-f542f40c5bdf@redhat.com> <13c5fe73-9e11-4465-b401-fc96a22dc5d1@redhat.com> <4cbc1e43-ea46-44de-9e2b-1c62dcd2b6d5@huaweicloud.com> <20250526154850.GA4156@redhat.com> <06bd94c0-fefe-4bdc-8483-2d9b6703c3d6@redhat.com> From: Pu Lehui In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-CM-TRANSID:gCh0CgBXBlurwDVovl+2Ng--.5058S2 X-Coremail-Antispam: 1UD129KBjvJXoW7Zw47Cr43tryfWrW8Gw1fXrb_yoW8ur1Upa y8Ja4jka1UJ348KFnFqF1vqF1Fq3yUtr4UXr15Xry5Awn8tr1xWF4agFW5ua4xZrWktw10 vrW2qF9xCay3AFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUv0b4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x 0267AKxVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG 6I80ewAv7VC0I7IYx2IY67AKxVWUGVWUXwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFV Cjc4AY6r1j6r4UM4x0Y48IcVAKI48JM4IIrI8v6xkF7I0E8cxan2IY04v7MxkF7I0En4kS 14v26r1q6r43MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I 8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUtVW8 ZwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x 0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_ Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IUb mii3UUUUU== X-CM-SenderInfo: psxovxtxl6x35dzhxuhorxvhhfrp/ X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: D1C2540003 X-Stat-Signature: z6geea9mr767pet5g9g3k6nzgfaapjje X-Rspam-User: X-HE-Tag: 1748353198-299440 X-HE-Meta: U2FsdGVkX1+/1YaTVBpjNZsovbkG5818sc0Jvnm/jmKal+nG0ebXdhI63pYlGOksXX4R1rpKC55eifdkS51VH+MCPL16TzkCQwks7fGmRJGtpZJoKv9qdzeuZdgRfV7/EtTKGJ7tvHbnHYHTTD+DWjveEwwa2CLDv9piuvcAEVxjyBw18AHSfJl+Icu8115Pp3fwLS+a2vpC5Clbw3M9zgoXnEmBY1pennaFxctlMxsiRv7KcmlzkbzZid7O4PW9HKnBBeEomOPdZx8m/w4okXO7mVmbyN7mzzXek+WElkP3Rft03cFOpW4zfrhXnFT3mtLWNkv45koMKShbYHarGvYEhgSxmIknySgF+QM4oEaLKi6Yu/GulPjIOHgTU9BtC1zDIIWxxzlUouvVu7/PE/70Kiee/3mhOHl1s5XbkxY7riDeiJCBpd6qUSqGQ+lb/fWFw0j8v3CblHhipyoNn8MB0ntpeE/UgYrDqRM+//lcWjf8JkneB6ZMzLlcbWNWie/ytKOZXRx12p/v3MC1z48sgCB4cOExMT8F6GCrLWqV8S5om1E1rTCkEdwkJSuhP+caqePf3gHW/4zhw7dlaZLCDHECf/EMxZmDp4gaJtIv0R9rYjRjkQG41LQlAXgl1PeQpmckBr7nFwYN+cyYjSajb0Kq54A/YJ+hjtsgFbMYG2uAVmjEEwIiuP4Iujc3DBLtzLV1M1iq1EyNFyfp/VcXPY+GO8JdW1m77cG9u+vQlCAKKdE2gn3MqOe75XQtY7o4lR/Zjk2hdhYjHzTzAVgT6jwNYdeuXAoECZTeaw7sXgyvHZMumQ+dfBi10jBjsOSpUOTEPNBxEaM/lkrKYZ1McPzhNThzPdmM0amfyJVScUaaEETZWlSt+2CU1qddmHFii+THuCU1LDujL5+WwXgL1LS2c7A903kLuhb/JGDk0NNE9T4witfzrU3KVg4yit2u5YMVkeNo5MlFqiH /ODlEcS9 mmR65lKSePALmpPn2+Io9yo82aH9TMuXoZYSVAtw/VnB3rFQFbG2fdVH77ajJWn+B5+hlmrGDDiSBVmfzDHgBBJv+HSD0XzieTfVtr327be90lhdmGU6JbRX4XGoK0Zx5yzvXSojDpuInKRhmxNym7o7v/cSM2ff1gH87H5TGUEJ+sf0= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2025/5/27 19:42, Lorenzo Stoakes wrote: > On Mon, May 26, 2025 at 08:46:07PM +0200, David Hildenbrand wrote: >> On 26.05.25 17:48, Oleg Nesterov wrote: >>> Hi Lehui, >>> >>> As I said, I don't understand mm/, so can't comment, but... >>> >>> On 05/26, Pu Lehui wrote: >>>> >>>> To make things simpler, perhaps we could try post-processing, that is: >>>> >>>> diff --git a/mm/mremap.c b/mm/mremap.c >>>> index 83e359754961..46a757fd26dc 100644 >>>> --- a/mm/mremap.c >>>> +++ b/mm/mremap.c >>>> @@ -240,6 +240,11 @@ static int move_ptes(struct pagetable_move_control >>>> *pmc, >>>> if (pte_none(ptep_get(old_pte))) >>>> continue; >>>> >>>> + /* skip move pte when expanded range has uprobe */ >>>> + if (unlikely(pte_present(*new_pte) && >>>> + vma_has_uprobes(pmc->new, new_addr, new_addr + >>>> PAGE_SIZE))) > > This feels like a horrible hack, note that we also move page tables at higher > page table levels _anyway_ so this would be broken by that (unless uprobes split > huge mappings). Got it. Won't do this try... > > If it's uprobe code that's putting the new PTE in place, then this is > just... yeah. I'm with David's suggestion of just disallowing this scenario, I > really dislike the idea that we're ok with an invalid condition being ok, only > to cover off this one specific case. > > >>>> + continue; >>>> + >>> >>> I was thinking about >>> >>> WARN_ON(!pte_none(*new_pte)) >>> >>> at the start of the main loop. >>> >>> Obviously not to fix the problem, but rather to make it more explicit. >> >> Yeah, WARN_ON_ONCE(). >> >> We really should fix the code to not install uprobes into the area we are >> moving. >> >> Likely, the correct fix will be to pass the range as well to uprobe_mmap(), >> and passing that range to build_probe_list(). >> >> Only when growing using mremap(), we want to call it on the extended range >> only. > > We might be able to implement a simpler version of the proposed patch though > which might avoid us needing to do something like this. > > Having a look... > >> >> -- >> Cheers, >> >> David / dhildenb >>