[PATCH 2/2] mm: prevent gup_fast from racing with COW during fork

[Jason Gunthorpe <jgg@nvidia.com>]

Since commit 70e806e4e645 ("mm: Do early cow for pinned pages during
fork() for ptes") pages under a FOLL_PIN will not be write protected
during COW for fork. This means that pages returned from
pin_user_pages(FOLL_WRITE) should not become write protected while the pin
is active.

However, there is a small race where get_user_pages_fast(FOLL_PIN) can
establish a FOLL_PIN at the same time copy_present_page() is write
protecting it:

        CPU 0                             CPU 1
   get_user_pages_fast()
    internal_get_user_pages_fast()
                                       copy_page_range()
                                         pte_alloc_map_lock()
                                           copy_present_page()
                                             atomic_read(has_pinned) == 0
					     page_maybe_dma_pinned() == false
     atomic_set(has_pinned, 1);
     gup_pgd_range()
      gup_pte_range()
       pte_t pte = gup_get_pte(ptep)
       pte_access_permitted(pte)
       try_grab_compound_head()
                                             pte = maybe_mkwrite()
	                                     set_pte_at();
                                         pte_unmap_unlock()
      // GUP now returns with a write protected page

The first attempt to resolve this by using the write protect caused
problems (and was missing a barrrier), see commit f3c64eda3e50 ("mm: avoid
early COW write protect games during fork()")

Instead wrap copy_p4d_range() with the write side of something like a
seqcount and check the read side around gup_pgd_range(). If there is a
collision then get_user_pages_fast() fails and falls back to slow GUP.

Slow GUP is safe against this race because copy_page_range() is only
called while holding the write side of the mmap_lock on the src mm_struct.

Fixes: f3c64eda3e50 ("mm: avoid early COW write protect games during fork()")
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lore.kernel.org/r/CAHk-=wi=iCnYCARbPGjkVJu9eyYeZ13N64tZYLdOB8CP5Q_PLw@mail.gmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 include/linux/mm_types.h |  6 ++++++
 kernel/fork.c            |  1 +
 mm/gup.c                 | 19 +++++++++++++++++++
 mm/memory.c              | 16 +++++++++++++++-
 4 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 5a9238f6caad97..8c7c9de476c4f8 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -446,6 +446,12 @@ struct mm_struct {
 		 */
 		atomic_t has_pinned;
 
+		/**
+		 * @write_protecet_seq: Odd when any thread is write
+		 * protecting pages in this mm, for instance during fork().
+		 */
+		unsigned long write_protect_seq;
+
 #ifdef CONFIG_MMU
 		atomic_long_t pgtables_bytes;	/* PTE page table pages */
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index 32083db7a2a23e..342243f621c742 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
 	mm->vmacache_seqnum = 0;
 	atomic_set(&mm->mm_users, 1);
 	atomic_set(&mm->mm_count, 1);
+	mm->write_protect_seq = 0;
 	mmap_init_lock(mm);
 	INIT_LIST_HEAD(&mm->mmlist);
 	mm->core_state = NULL;
diff --git a/mm/gup.c b/mm/gup.c
index ecbe1639ea2af7..2c1a1e0555479e 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2677,12 +2677,19 @@ static unsigned int lockless_pages_from_mm(unsigned long addr,
 					   struct page **pages)
 {
 	unsigned long flags;
+	unsigned long seq;
 	int nr_pinned = 0;
 
 	if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) ||
 	    !gup_fast_permitted(addr, end))
 		return 0;
 
+	if (gup_flags & FOLL_PIN) {
+		seq = smp_load_acquire(&current->mm->write_protect_seq);
+		if (seq & 1)
+			return 0;
+	}
+
 	/*
 	 * Disable interrupts. The nested form is used, in order to allow full,
 	 * general purpose use of this routine.
@@ -2697,6 +2704,18 @@ static unsigned int lockless_pages_from_mm(unsigned long addr,
 	local_irq_save(flags);
 	gup_pgd_range(addr, end, gup_flags, pages, &nr_pinned);
 	local_irq_restore(flags);
+
+	/*
+	 * When pinning pages for DMA there could be a concurrent write protect
+	 * from fork() via copy_page_range(), in this case always fail fast GUP.
+	 */
+	if (gup_flags & FOLL_PIN) {
+		smp_rmb();
+		if (READ_ONCE(current->mm->write_protect_seq) != seq) {
+			unpin_user_pages(pages, nr_pinned);
+			return 0;
+		}
+	}
 	return nr_pinned;
 }
 
diff --git a/mm/memory.c b/mm/memory.c
index c48f8df6e50268..e2f959cce8563d 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1171,6 +1171,17 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
 		mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE,
 					0, src_vma, src_mm, addr, end);
 		mmu_notifier_invalidate_range_start(&range);
+		/*
+		 * This is like a seqcount where the mmap_lock provides
+		 * serialization for the write side. However, unlike seqcount
+		 * the read side falls back to obtaining the mmap_lock rather
+		 * than spinning. For this reason none of the preempt related
+		 * machinery in seqcount is desired here.
+		 */
+		mmap_assert_write_locked(src_mm);
+		WRITE_ONCE(src_mm->write_protect_seq,
+			   src_mm->write_protect_seq + 1);
+		smp_wmb();
 	}
 
 	ret = 0;
@@ -1187,8 +1198,11 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
 		}
 	} while (dst_pgd++, src_pgd++, addr = next, addr != end);
 
-	if (is_cow)
+	if (is_cow) {
+		smp_store_release(&src_mm->write_protect_seq,
+				  src_mm->write_protect_seq + 1);
 		mmu_notifier_invalidate_range_end(&range);
+	}
 	return ret;
 }
 
-- 
2.28.0