From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB225C77B75 for ; Wed, 17 May 2023 17:21:02 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 126B1900004; Wed, 17 May 2023 13:21:02 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0D7E8900003; Wed, 17 May 2023 13:21:02 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E6DC3900004; Wed, 17 May 2023 13:21:01 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id BFC48900003 for ; Wed, 17 May 2023 13:21:01 -0400 (EDT) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 8D3A21A069B for ; Wed, 17 May 2023 17:21:01 +0000 (UTC) X-FDA: 80800412322.26.6EB62B6 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by imf26.hostedemail.com (Postfix) with ESMTP id 559F814000A for ; Wed, 17 May 2023 17:20:58 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=gmail.com header.s=20221208 header.b=fUZqBmeK; spf=pass (imf26.hostedemail.com: domain of lstoakes@gmail.com designates 209.85.128.52 as permitted sender) smtp.mailfrom=lstoakes@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684344059; a=rsa-sha256; cv=none; b=RCBxUFIgxUVCmNdsBwhpk5CIExqqQ1XSSr36/ip5ZutCNXQWf6jGO/0kceOdVVOtTyJk8W axWBGHKrfBUiBA5SneDDjTsh/yuJCFwbXIqTriunXsYuYUADQAsMOca/duZUMZ0v8yRHCS NSt34A3H+jvBN3B4qaA5oR7YmXevSF0= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=gmail.com header.s=20221208 header.b=fUZqBmeK; spf=pass (imf26.hostedemail.com: domain of lstoakes@gmail.com designates 209.85.128.52 as permitted sender) smtp.mailfrom=lstoakes@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684344059; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=HA+ixEOwCV4Hwwy5VjUh4gi4ftgl8VXHtW5tml/MLqE=; b=BQmNjs73zKBfVxpZkrjV9IcTjSME1flMChlybGsJZS/MwUw1+MuQT2j4DB+hTNyxHRB3s8 QR0/RVN0Ckbj7+RDtl499/J8RvXCvKhZPtiuxi+NOpAmmQqglR2h7ARseKVTdIyM9uHwYp UO+g0VAQVOT+Z2ACD/FJo89YwIhlkFM= Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-3f42c86543bso7478885e9.3 for ; Wed, 17 May 2023 10:20:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1684344057; x=1686936057; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=HA+ixEOwCV4Hwwy5VjUh4gi4ftgl8VXHtW5tml/MLqE=; b=fUZqBmeKT6KmMPjBLnquAOsfG4TxLX5U+yqd4jMj4CFMMPxPx5afekJgE9u3N60vFs czRuwzlzqq0DJbKxeVpYWZcSNn2bWwMsAcNS4KH9J56AGvXDgoKRur/7XwWNtmJ6nzRY OsQUioZJqLSVX5C13tPPiwxRz/VpXwHiOU4FKE0UA8ZK9v0oWINFMWEwPHNw+TRLo0JB QV4RTp7oLWMayyEg72wa63GGOQ+Ga2bFwXZ2ZFm1mEZhcLA0y7eT0u2PWWemquHO5C3q K1hp7fnCac5RZ85ATb61ffkpdjWaEZM8haCq9kVErKIrE+mcClLIASt/LwgP+5vQt/rA D6ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684344057; x=1686936057; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=HA+ixEOwCV4Hwwy5VjUh4gi4ftgl8VXHtW5tml/MLqE=; b=kbziUtVPnSU8fD7lCPTSpNzEwTZC62PjDlaSTkJs+MZ14HRFpMFFXireBYm0jZ8zys Xf3F2r+e/3ZdZiv0aYp18kcT8+7Io+MwzpE6GPBRdqI4vRkISMUJHDc59rCJxsvUVEtd CczUzWNE+Dk019kkUOUQQTpiGTkQS9okSWZfGogbH+YKQoVLGZ7ZFx5Fr4aQiW7wYoV2 /RECuvWSWqq3aFMwdFtbK0KnF9YOsJDtQjdl9LixWLbCriaPU1Lo9jsGzsqh05vDmR5K 6jBJqt/lWHjD32OKY+i0Y12TuIFK3vUGXFr/sv2ZGjeEflGTMjg+9qJetOvTc5aMlU2A cxNA== X-Gm-Message-State: AC+VfDxxS48iAYhppWQohWODOjfEtVlnS6LWMmbIYyvXHdV9XcApiLUy 3Zg62sSZvEYYvsAyVh4xDT8= X-Google-Smtp-Source: ACHHUZ42RsRkUPWyt7iyPDUgEzeLUAEWnTphTkFVUV2Ao1RrkLmyQ1485/W7O1jeZ5yWCPU6AKklrA== X-Received: by 2002:a7b:c318:0:b0:3f0:a08e:811b with SMTP id k24-20020a7bc318000000b003f0a08e811bmr29765842wmj.13.1684344057210; Wed, 17 May 2023 10:20:57 -0700 (PDT) Received: from localhost (host86-156-84-164.range86-156.btcentralplus.com. [86.156.84.164]) by smtp.gmail.com with ESMTPSA id y26-20020a7bcd9a000000b003f42a75ac2asm2891446wmj.23.2023.05.17.10.20.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 May 2023 10:20:56 -0700 (PDT) Date: Wed, 17 May 2023 18:20:55 +0100 From: Lorenzo Stoakes To: Peter Xu Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, Andrew Morton , "Liam R . Howlett" , Mark Rutland , Andrea Arcangeli , Mike Rapoport , Alexander Viro , linux-stable Subject: Re: [PATCH 1/2] mm/uffd: Fix vma operation where start addr cuts part of vma Message-ID: <4a68aee6-68d9-4d17-bb7f-cda3910f6f1f@lucifer.local> References: <20230517150408.3411044-1-peterx@redhat.com> <20230517150408.3411044-2-peterx@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230517150408.3411044-2-peterx@redhat.com> X-Rspam-User: X-Stat-Signature: s53h8s7gzhqkbdq5jon81j4sha6qdfjc X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 559F814000A X-HE-Tag: 1684344058-53585 X-HE-Meta: U2FsdGVkX180D22Csn6OuBvjT54VwVvq9Lk12Vg1r2AxL0GgauIN8pvod+Y1ewC+jS0YG2WZVhy31nH0IIWJPe6Pt8WB5hhTvUxExzvCG4QSiwl2tTPiS8b/ftOIuEcY69IJn3WFstUyo/hz1AI0lgdlqC0oDLylRzQ57DvZj4nShqnM+mRZ/nQ7XOkVUcqdLcxgeIa8T1QQnq1sdI3espP9Q57cqWulKbdH2U75++l+KtPeOMf3D62uJGSmJGeWD9HmDkYSb6D963K19eo/FXdHOO94Ch2JuVp08KAsVJRLBlGxNOIu+tOsQWDIfyXqELbUo97eiqjlk03Zn8ESkgDvp8IUEdOGNAhTdjDYOUw0LJ2h0ZOIqDNoA/ALUKnbFCrdW19epC+v2naKqKvUBs1u/CISPG6bvCoeyjw7ys+rb7/aodpnl2YkXXtwc7d8Q+jGbvlrY6A8cuF5KZOLMLUQnJD65O/tZYWtPR9y0X2ViEbk4+PanyGYiE+rwnwz8GnM+fOQ6rt525WPNGjLfXTCzGAcHZuG0EZaFlia8dNPuXNPoFbUMR4MeGZYCTMQBWkcZpzwaYXzc/jdAhsCyo0tlJQxiAk172ZlvXnI+EcOLCG3vax/GgozAzviHVp9B+/he44iPL7Ho0MGaLquBnGsyyr0j5qKl+9wy6g4lGjZEyIWcW1EsLrcIwJTuWUnD6P5kyJ3fLRRnnsigED6cpFLAkvkn5g2RFUsKPcoJsGQhe7/hWaRpFyTgLgymHyens7atS03WL8JQTRzXoAC2ruZRonkopVluHMCWfegfkQASzLjCAY1Q3D927GuXfdiiZUJskBk3VXV3wfCx1+uFTiVAYTTbb3j1pbUzbzEkzKd91Ncy/79wuWvJFRfqHTY/trITsVg7EShxJKDgSFb7+J1v252RhktaVbR2tdpCtm3xqDvVBRgGYvZH3t3OpAzNHr3BP4/p9Q1QOycEt4 QXBTSEiy ZXmd8jLO5p8B1jCmeNifU1uL7pR3xuFOCbWjGoPkwHMPEDlaYyNlA3PxzD8lXdKQ31ctZOp9Fk32zbdNW5rmrkBdVRt9xx4Lv3gBp382zvM2JeF/cBnOrDkDKltW8SNU+VGyD0xzg1r4VykxJnGRWdVJspa7PlEBIb4dMovXO2Q+cM1HWrUc5WcNJtuxzEucteVBO7Q6vOpFrfgdmMBcGcWjVoWTAb94LFcCJnkKleOoohNX27gof4Ui6KgB3IBAj2GO5DlByPDV9e7JO0mXM0/ffMV7E7VNrFPSrnYMDXvCJeKod8P5LcUgCoBR4SW9uDtrbnRSG5xZwHW4Q6kT4501ckHEWT3WYb6Rs4ccGpICgsaUw5fXAmGT2WvjQTNkRUqPpZmsM+wqaHMdXIWIk/ie9BmrjYhOELEoxklhe68At/w2FypyU2N/egvYvT4CG1LNq1kv/KIXU41GBpdZNdAg0zR8F6VWZFXe9n9AS1GbAXVT0F+k0KGqLxhrgE21xtzL+1INHAOacerRqlz5muSeZv39ibijFbpyK X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, May 17, 2023 at 11:04:07AM -0400, Peter Xu wrote: > It seems vma merging with uffd paths is broken with either > register/unregister, where right now we can feed wrong parameters to > vma_merge() and it's found by recent patch which moved asserts upwards in > vma_merge() by Lorenzo Stoakes: > > https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ > > The problem is in the current code base we didn't fixup "prev" for the case > where "start" address can be within the "prev" vma section. In that case > we should have "prev" points to the current vma rather than the previous > one when feeding to vma_merge(). This doesn't seem quite correct, perhaps - "where start is contained within vma but not clamped to its start. We need to convert this into case 4 which permits subdivision of prev by assigning vma to prev. As we loop, each subsequent VMA will be clamped to the start." > > This patch will eliminate the report and make sure vma_merge() calls will > become legal again. > > One thing to mention is that the "Fixes: 29417d292bd0" below is there only > to help explain where the warning can start to trigger, the real commit to > fix should be 69dbe6daf104. Commit 29417d292bd0 helps us to identify the > issue, but unfortunately we may want to keep it in Fixes too just to ease > kernel backporters for easier tracking. > > Cc: Lorenzo Stoakes > Cc: Mike Rapoport (IBM) > Cc: Liam R. Howlett > Reported-by: Mark Rutland > Fixes: 29417d292bd0 ("mm/mmap/vma_merge: always check invariants") > Fixes: 69dbe6daf104 ("userfaultfd: use maple tree iterator to iterate VMAs") > Closes: https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ > Cc: linux-stable > Signed-off-by: Peter Xu > --- > fs/userfaultfd.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c > index 0fd96d6e39ce..17c8c345dac4 100644 > --- a/fs/userfaultfd.c > +++ b/fs/userfaultfd.c > @@ -1459,6 +1459,8 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, > > vma_iter_set(&vmi, start); > prev = vma_prev(&vmi); > + if (vma->vm_start < start) > + prev = vma; > > ret = 0; > for_each_vma_range(vmi, vma, end) { > @@ -1625,6 +1627,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, > > vma_iter_set(&vmi, start); > prev = vma_prev(&vmi); > + if (vma->vm_start < start) > + prev = vma; > + > ret = 0; > for_each_vma_range(vmi, vma, end) { > cond_resched(); > -- > 2.39.1 > Other than that looks good:- Reviewed-by: Lorenzo Stoakes