[patch linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[patch linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Dan Carpenter]

kunmap_atomic() and kunmap() take different pointers.  People often get
these mixed up.

Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/mm/memory.c b/mm/memory.c
index 6012a05..dfd3604 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
 				(const void __user *)(src + i * PAGE_SIZE),
 				PAGE_SIZE);
 		if (allow_pagefault)
-			kunmap(page_kaddr);
+			kunmap(dst_page + 1);
 		else
 			kunmap_atomic(page_kaddr);
 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Michal Hocko]

On Thu 12-01-17 22:20:52, Dan Carpenter wrote:
> kunmap_atomic() and kunmap() take different pointers.  People often get
> these mixed up.
> 
> Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")

This looks like a linux-next sha1. This is not stable and will change...

> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 6012a05..dfd3604 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
>  				(const void __user *)(src + i * PAGE_SIZE),
>  				PAGE_SIZE);
>  		if (allow_pagefault)
> -			kunmap(page_kaddr);
> +			kunmap(dst_page + 1);

I guess you meant dst_page + i

>  		else
>  			kunmap_atomic(page_kaddr);
>  

-- 
Michal Hocko
SUSE Labs

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Dan Carpenter]

On Thu, Jan 12, 2017 at 08:33:27PM +0100, Michal Hocko wrote:
> On Thu 12-01-17 22:20:52, Dan Carpenter wrote:
> > kunmap_atomic() and kunmap() take different pointers.  People often get
> > these mixed up.
> > 
> > Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
> 
> This looks like a linux-next sha1. This is not stable and will change...
> 

Yeah.  But probably Andrew is just going to fold it into the original
anyway.  Probably most of linux-next trees don't rebase so the hash is
good and the people who rebase fold it in so it doesn't show up in the
released code.  It basically never hurts to have the Fixes tag.

> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > diff --git a/mm/memory.c b/mm/memory.c
> > index 6012a05..dfd3604 100644
> > --- a/mm/memory.c
> > +++ b/mm/memory.c
> > @@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
> >  				(const void __user *)(src + i * PAGE_SIZE),
> >  				PAGE_SIZE);
> >  		if (allow_pagefault)
> > -			kunmap(page_kaddr);
> > +			kunmap(dst_page + 1);
> 
> I guess you meant dst_page + i

Huh.  I would have sworn I copy and pasted this.  Anyway, thanks for
catching this.  I will resend.

regards,
dan carpenter

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Michal Hocko]

On Fri 13-01-17 11:16:10, Dan Carpenter wrote:
> On Thu, Jan 12, 2017 at 08:33:27PM +0100, Michal Hocko wrote:
> > On Thu 12-01-17 22:20:52, Dan Carpenter wrote:
> > > kunmap_atomic() and kunmap() take different pointers.  People often get
> > > these mixed up.
> > > 
> > > Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
> > 
> > This looks like a linux-next sha1. This is not stable and will change...
> > 
> 
> Yeah.  But probably Andrew is just going to fold it into the original
> anyway.  Probably most of linux-next trees don't rebase so the hash is
> good and the people who rebase fold it in so it doesn't show up in the
> released code.  It basically never hurts to have the Fixes tag.

Yeah, I have a vague recollection that some of those sha1 leaked to
Linus. Do not have any examples handy though. It is true that Andrew
folds those fixes into the original patch so it might be helpful to
have
Fixes: mmotm-patch-file-name.patch
instead.

-- 
Michal Hocko
SUSE Labs

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Dan Carpenter]

On Fri, Jan 13, 2017 at 09:26:08AM +0100, Michal Hocko wrote:
> On Fri 13-01-17 11:16:10, Dan Carpenter wrote:
> > On Thu, Jan 12, 2017 at 08:33:27PM +0100, Michal Hocko wrote:
> > > On Thu 12-01-17 22:20:52, Dan Carpenter wrote:
> > > > kunmap_atomic() and kunmap() take different pointers.  People often get
> > > > these mixed up.
> > > > 
> > > > Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
> > > 
> > > This looks like a linux-next sha1. This is not stable and will change...
> > > 
> > 
> > Yeah.  But probably Andrew is just going to fold it into the original
> > anyway.  Probably most of linux-next trees don't rebase so the hash is
> > good and the people who rebase fold it in so it doesn't show up in the
> > released code.  It basically never hurts to have the Fixes tag.
> 
> Yeah, I have a vague recollection that some of those sha1 leaked to
> Linus. Do not have any examples handy though. It is true that Andrew
> folds those fixes into the original patch so it might be helpful to
> have
> Fixes: mmotm-patch-file-name.patch

I have no idea how to do that.  I'm always just working on linux-next
and not the individual trees...  I'm interested to hear from Andrew
what's easiest because I don't know at all how quilt works.

My work flow is that I have scripts to generate patches from within vim.
Most of the time I'm just working on one file but occasionally I will
combine two patches together in mutt.

For Dave's networking patches I have a separate git tree where I try to
apply them to net and then net-next to see which tree it should go into.
Otherwise, I generally assume the maintainer knows which tree they
belong in.

regards,
dan carpenter

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

[patch v2 linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Dan Carpenter]

kunmap_atomic() and kunmap() take different pointers.  People often get
these mixed up.

Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: I was also unmapping the wrong pointer because I had a typo.

diff --git a/mm/memory.c b/mm/memory.c
index 6012a05..aca8ef6 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
 				(const void __user *)(src + i * PAGE_SIZE),
 				PAGE_SIZE);
 		if (allow_pagefault)
-			kunmap(page_kaddr);
+			kunmap(page_kaddr + i);
 		else
 			kunmap_atomic(page_kaddr);
 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch v2 linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Michal Hocko]

On Fri 13-01-17 11:26:08, Dan Carpenter wrote:
> kunmap_atomic() and kunmap() take different pointers.  People often get
> these mixed up.
> 
> Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Michal Hocko <mhocko@suse.com>

> ---
> v2: I was also unmapping the wrong pointer because I had a typo.
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 6012a05..aca8ef6 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
>  				(const void __user *)(src + i * PAGE_SIZE),
>  				PAGE_SIZE);
>  		if (allow_pagefault)
> -			kunmap(page_kaddr);
> +			kunmap(page_kaddr + i);
>  		else
>  			kunmap_atomic(page_kaddr);
>  

-- 
Michal Hocko
SUSE Labs

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch v2 linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Mike Kravetz]

On 01/13/2017 12:40 AM, Michal Hocko wrote:
> On Fri 13-01-17 11:26:08, Dan Carpenter wrote:
>> kunmap_atomic() and kunmap() take different pointers.  People often get
>> these mixed up.
>>
>> Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> Acked-by: Michal Hocko <mhocko@suse.com>

Thanks for catching this!

Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>

-- 
Mike Kravetz

> 
>> ---
>> v2: I was also unmapping the wrong pointer because I had a typo.
>>
>> diff --git a/mm/memory.c b/mm/memory.c
>> index 6012a05..aca8ef6 100644
>> --- a/mm/memory.c
>> +++ b/mm/memory.c
>> @@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
>>  				(const void __user *)(src + i * PAGE_SIZE),
>>  				PAGE_SIZE);
>>  		if (allow_pagefault)
>> -			kunmap(page_kaddr);
>> +			kunmap(page_kaddr + i);
>>  		else
>>  			kunmap_atomic(page_kaddr);
>>  
> 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch v2 linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Hugh Dickins]

On Fri, 13 Jan 2017, Dan Carpenter wrote:

> kunmap_atomic() and kunmap() take different pointers.  People often get
> these mixed up.
> 
> Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: I was also unmapping the wrong pointer because I had a typo.
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 6012a05..aca8ef6 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
>  				(const void __user *)(src + i * PAGE_SIZE),
>  				PAGE_SIZE);
>  		if (allow_pagefault)
> -			kunmap(page_kaddr);
> +			kunmap(page_kaddr + i);
>  		else
>  			kunmap_atomic(page_kaddr);

I think you need to look at that again.

Hugh

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch v2 linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Andrew Morton]

On Fri, 13 Jan 2017 16:02:37 -0800 (PST) Hugh Dickins <hughd@google.com> wrote:

> On Fri, 13 Jan 2017, Dan Carpenter wrote:
> 
> > kunmap_atomic() and kunmap() take different pointers.  People often get
> > these mixed up.
> > 
> > Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > v2: I was also unmapping the wrong pointer because I had a typo.
> > 
> > diff --git a/mm/memory.c b/mm/memory.c
> > index 6012a05..aca8ef6 100644
> > --- a/mm/memory.c
> > +++ b/mm/memory.c
> > @@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
> >  				(const void __user *)(src + i * PAGE_SIZE),
> >  				PAGE_SIZE);
> >  		if (allow_pagefault)
> > -			kunmap(page_kaddr);
> > +			kunmap(page_kaddr + i);
> >  		else
> >  			kunmap_atomic(page_kaddr);
> 
> I think you need to look at that again.
> 

um, yup.

--- a/mm/memory.c~userfaultfd-hugetlbfs-fix-__mcopy_atomic_hugetlb-retry-error-processing-fix-fix
+++ a/mm/memory.c
@@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct pag
 				(const void __user *)(src + i * PAGE_SIZE),
 				PAGE_SIZE);
 		if (allow_pagefault)
-			kunmap(page_kaddr + i);
+			kunmap(dst_page + i);
 		else
 			kunmap_atomic(page_kaddr);
 
_

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch v2 linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Dan Carpenter]

Thanks, Andrew.

regards,
dan carpenter

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [patch v2 linux-next] userfaultfd: hugetlbfs: unmap the correct pointer

[Dan Carpenter]

On Fri, Jan 13, 2017 at 04:02:37PM -0800, Hugh Dickins wrote:
> On Fri, 13 Jan 2017, Dan Carpenter wrote:
> 
> > kunmap_atomic() and kunmap() take different pointers.  People often get
> > these mixed up.
> > 
> > Fixes: 16374db2e9a0 ("userfaultfd: hugetlbfs: fix __mcopy_atomic_hugetlb retry/error processing")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > v2: I was also unmapping the wrong pointer because I had a typo.
> > 
> > diff --git a/mm/memory.c b/mm/memory.c
> > index 6012a05..aca8ef6 100644
> > --- a/mm/memory.c
> > +++ b/mm/memory.c
> > @@ -4172,7 +4172,7 @@ long copy_huge_page_from_user(struct page *dst_page,
> >  				(const void __user *)(src + i * PAGE_SIZE),
> >  				PAGE_SIZE);
> >  		if (allow_pagefault)
> > -			kunmap(page_kaddr);
> > +			kunmap(page_kaddr + i);
> >  		else
> >  			kunmap_atomic(page_kaddr);
> 
> I think you need to look at that again.

Oh wow...  What absolute heck!  I can't believe how badly I'm messing
up on this.

regards,
dan carpenter

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>