From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18D50C2D0BE for ; Wed, 4 Dec 2019 22:52:47 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id CE99E22525 for ; Wed, 4 Dec 2019 22:52:46 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="w7DTbYL0" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CE99E22525 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 494BB6B0CF7; Wed, 4 Dec 2019 17:52:46 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 41F796B0CF8; Wed, 4 Dec 2019 17:52:46 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 30C006B0CF9; Wed, 4 Dec 2019 17:52:46 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0213.hostedemail.com [216.40.44.213]) by kanga.kvack.org (Postfix) with ESMTP id 175EB6B0CF7 for ; Wed, 4 Dec 2019 17:52:46 -0500 (EST) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with SMTP id B0D59180AD80F for ; Wed, 4 Dec 2019 22:52:45 +0000 (UTC) X-FDA: 76228960290.27.dress35_8c77e4a18a52a X-HE-Tag: dress35_8c77e4a18a52a X-Filterd-Recvd-Size: 6182 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf07.hostedemail.com (Postfix) with ESMTP for ; Wed, 4 Dec 2019 22:52:45 +0000 (UTC) Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 072BE2245C; Wed, 4 Dec 2019 22:52:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1575499964; bh=n8L4HjG0nstbb5b9L7QsBYJ4DJxlKRRjcjIL7qJTEVQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=w7DTbYL0lMEOlHXfnKBOVRMVuIrEbUX6D0T5WbW2lPNWDK3QXrDjXUHjB5hvRyC98 J7wjLJlN7Y2LB6z04ZMBQtXbQJqLoOgvObidMg4kXETgmU9VNqJHbBs30KIyPE037+ pUPjF6oPZc15pNtXsEZ9/IPD/20z9A/Mo65GaLOM= Date: Wed, 4 Dec 2019 23:52:41 +0100 From: Greg KH To: Vlastimil Babka Cc: Sasha Levin , stable@vger.kernel.org, Ben Hutchings , Matthew Wilcox , Ajay Kaher , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH STABLE ONLY] add missing page refcount overflow checks Message-ID: <20191204225241.GA3715390@kroah.com> References: <20191129090351.3507-1-vbabka@suse.cz> <20191201165510.GT5861@sasha-vm> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Dec 03, 2019 at 01:50:26PM +0100, Vlastimil Babka wrote: > On 12/1/19 5:55 PM, Sasha Levin wrote: > > On Fri, Nov 29, 2019 at 10:03:48AM +0100, Vlastimil Babka wrote: > >> This collection of patches add the missing overflow checks in arch-specific > >> gup.c variants for x86 and s390. Those were missed in backport of 8fde12ca79af > >> ("mm: prevent get_user_pages() from overflowing page refcount") as mainline > >> had a single gup.c implementation at that point. See individual patches for > >> details. > > > > Queued up, thanks! > > Please replace the 4.9 version with the following fixed one, thanks to Ben: > > ----8<---- > >From fe7f18bd152094f8516d79e847fcb5453a6f8368 Mon Sep 17 00:00:00 2001 > From: Vlastimil Babka > Date: Wed, 6 Nov 2019 16:32:57 +0100 > Subject: [PATCH] mm, gup: add missing refcount overflow checks on x86 and s390 > > The mainline commit 8fde12ca79af ("mm: prevent get_user_pages() from > overflowing page refcount") was backported to 4.9.y stable as commit > 2ed768cfd895. The backport however missed that in 4.9, there are several > arch-specific gup.c versions with fast gup implementations, so these do not > prevent refcount overflow. > > This is partially fixed for x86 in stable-only commit d73af79742e7 ("x86, mm, > gup: prevent get_page() race with munmap in paravirt guest"). This stable-only > commit adds missing parts to x86 version, as well as s390 version, both taken > from the SUSE SLES/openSUSE 4.12-based kernels. > > The remaining architectures with own gup.c are sparc, mips, sh. It's unlikely > the known overflow scenario based on FUSE, which needs 140GB of RAM, is a > problem for those architectures, and I don't feel confident enough to patch > them. > > Signed-off-by: Vlastimil Babka > --- > arch/s390/mm/gup.c | 9 ++++++--- > arch/x86/mm/gup.c | 9 ++++++++- > 2 files changed, 14 insertions(+), 4 deletions(-) > > diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c > index 97fc449a7470..cf045f56581e 100644 > --- a/arch/s390/mm/gup.c > +++ b/arch/s390/mm/gup.c > @@ -38,7 +38,8 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, > VM_BUG_ON(!pfn_valid(pte_pfn(pte))); > page = pte_page(pte); > head = compound_head(page); > - if (!page_cache_get_speculative(head)) > + if (WARN_ON_ONCE(page_ref_count(head) < 0) > + || !page_cache_get_speculative(head)) > return 0; > if (unlikely(pte_val(pte) != pte_val(*ptep))) { > put_page(head); > @@ -76,7 +77,8 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr, > refs++; > } while (addr += PAGE_SIZE, addr != end); > > - if (!page_cache_add_speculative(head, refs)) { > + if (WARN_ON_ONCE(page_ref_count(head) < 0) > + || !page_cache_add_speculative(head, refs)) { > *nr -= refs; > return 0; > } > @@ -150,7 +152,8 @@ static int gup_huge_pud(pud_t *pudp, pud_t pud, unsigned long addr, > refs++; > } while (addr += PAGE_SIZE, addr != end); > > - if (!page_cache_add_speculative(head, refs)) { > + if (WARN_ON_ONCE(page_ref_count(head) < 0) > + || !page_cache_add_speculative(head, refs)) { > *nr -= refs; > return 0; > } > diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c > index d7db45bdfb3b..82f727fbbbd2 100644 > --- a/arch/x86/mm/gup.c > +++ b/arch/x86/mm/gup.c > @@ -202,9 +202,12 @@ static int __gup_device_huge_pmd(pmd_t pmd, unsigned long addr, > undo_dev_pagemap(nr, nr_start, pages); > return 0; > } > + if (unlikely(!try_get_page(page))) { > + put_dev_pagemap(pgmap); > + return 0; > + } > SetPageReferenced(page); > pages[*nr] = page; > - get_page(page); > put_dev_pagemap(pgmap); > (*nr)++; > pfn++; > @@ -230,6 +233,8 @@ static noinline int gup_huge_pmd(pmd_t pmd, unsigned long addr, > > refs = 0; > head = pmd_page(pmd); > + if (WARN_ON_ONCE(page_ref_count(head) <= 0)) > + return 0; > page = head + ((addr & ~PMD_MASK) >> PAGE_SHIFT); > do { > VM_BUG_ON_PAGE(compound_head(page) != head, page); > @@ -289,6 +294,8 @@ static noinline int gup_huge_pud(pud_t pud, unsigned long addr, > > refs = 0; > head = pud_page(pud); > + if (WARN_ON_ONCE(page_ref_count(head) <= 0)) > + return 0; > page = head + ((addr & ~PUD_MASK) >> PAGE_SHIFT); > do { > VM_BUG_ON_PAGE(compound_head(page) != head, page); > -- > 2.24.0 > > > Now updated, sorry I missed this earlier. greg k-h