From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16B51C77B75 for ; Wed, 17 May 2023 18:41:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A7FBA900005; Wed, 17 May 2023 14:41:05 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A080A900003; Wed, 17 May 2023 14:41:05 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 882D4900005; Wed, 17 May 2023 14:41:05 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 76389900003 for ; Wed, 17 May 2023 14:41:05 -0400 (EDT) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 464821206D3 for ; Wed, 17 May 2023 18:41:05 +0000 (UTC) X-FDA: 80800614090.25.39B9731 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by imf11.hostedemail.com (Postfix) with ESMTP id 62C2D40014 for ; Wed, 17 May 2023 18:41:03 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=gmail.com header.s=20221208 header.b=CKpZI810; spf=pass (imf11.hostedemail.com: domain of lstoakes@gmail.com designates 209.85.128.54 as permitted sender) smtp.mailfrom=lstoakes@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684348863; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ekzd9ykcWrQOgqzX/JwQtGZ8le07mwTGWPLkenw5T0A=; b=m8ppedKm8e2yFRsqKkoz+0f422RprvYmi6HD011IOflwM1qE0z1cabRNwayC0mFo7Q9UCu rSz05K22HGIFCTv3Gr/Im4lPOmh99WSL+7v/Bmd7+2qOo9X2g1ngftPEsbvZ1DIoXMpjwQ gcWvzbhkEp1+p/aBZ6MrIKNJfYnTtdI= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684348863; a=rsa-sha256; cv=none; b=Nys9S601qC7Lz7M9iFaQNYyWSj85aUFfpKNihqQwBiZ9t8Q128+NsJDKB4+5g6BF6yevIq X1FdTNfV2pX+KUz7nZHoN16LJ7ZS3Wh5g+7GUT2NL2EWr+fNmslQWBk1cVbLevTPmw8AYR PpdXHy3H7QbWqIs7ncjq7UOhGaoQNYM= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=gmail.com header.s=20221208 header.b=CKpZI810; spf=pass (imf11.hostedemail.com: domain of lstoakes@gmail.com designates 209.85.128.54 as permitted sender) smtp.mailfrom=lstoakes@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-3f4c6c4b51eso11405315e9.2 for ; Wed, 17 May 2023 11:41:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1684348861; x=1686940861; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=ekzd9ykcWrQOgqzX/JwQtGZ8le07mwTGWPLkenw5T0A=; b=CKpZI810bSF3vZ6M77dq0q0tvFQ3oBcOiPJ4IH0shOSgLeiQfyzLEeuXZYzrhDcirh F3yj94jTS0xo7+1bgZ1Kotssi1Gb3Vz+ySb7LpQRLdGZUVuG5D4lxVDrdf4dPF6Di219 I0p4BCdqTI9rgdh0XS/vxEzVcTpiMlymw3OF8aM9lu3epk3u8UuavHWXap0ujWq+88Jp qorhopGE4QHdoS7Tg8TTXVlE142BJa8sImw94ZqAfoiqdqjYF7qYCi3VaX9B29efPxCW vWCzH/+8Ob2AGY4cd5T5htscFyMJEvsjLXrDv3fAUP5GCiG+/7mXULV9z3c924BkgWxP HAsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684348861; x=1686940861; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ekzd9ykcWrQOgqzX/JwQtGZ8le07mwTGWPLkenw5T0A=; b=eNrEuinU8AB1WpEunght6vd6IRrwQqOSO39xvH2nf9xn/1Frm3pKgetBHkNLY7JLVV 7M24GFavPnyb5w0ny5YrCPe4EDFDBqbrhyo9HYLNJ+lCgdgvwvlvPHtZqSC9LftYEdiH PPlzQQcgj+F0prWUKv0gc3i2Rrzxidc78Kg8ILgkW6uqvMGSJ5BRvcFb9JzPsrzMduBI Y10/46DgYDgVB8IqX7TRbf+wuJi6wdwcJknubbU6yzUcgsbkTXsMu8/0OoRS6u62OKxx Kgk8sL3Vle5Uvto3iWmI2aw0RXOFNiPh7PCJk3bvZ98HSLN8EAqRSYxxThLrSy0idrAJ jKUA== X-Gm-Message-State: AC+VfDwGAd+jI7YTApYSxOg5sCJQhw6czcPjFLx57ZXbZku8zDpv2Rgc modv1CuWGKXicceg5aTNuuA= X-Google-Smtp-Source: ACHHUZ5w0132rEXA52wnoj6C+2IapoXe21N4e/7mZr4YoZA/CbJHgWn7BiG9bdWDQlHLjIYFEZCGsQ== X-Received: by 2002:a1c:4c19:0:b0:3f4:27ff:7d52 with SMTP id z25-20020a1c4c19000000b003f427ff7d52mr24093698wmf.2.1684348861270; Wed, 17 May 2023 11:41:01 -0700 (PDT) Received: from localhost (host86-156-84-164.range86-156.btcentralplus.com. [86.156.84.164]) by smtp.gmail.com with ESMTPSA id s22-20020a1cf216000000b003f080b2f9f4sm3043074wmc.27.2023.05.17.11.41.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 May 2023 11:41:00 -0700 (PDT) Date: Wed, 17 May 2023 19:40:59 +0100 From: Lorenzo Stoakes To: Peter Xu Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, Andrew Morton , "Liam R . Howlett" , Mark Rutland , Andrea Arcangeli , Mike Rapoport , Alexander Viro , linux-stable Subject: Re: [PATCH 1/2] mm/uffd: Fix vma operation where start addr cuts part of vma Message-ID: <99566f92-9b97-4b2b-b75b-860532e851fd@lucifer.local> References: <20230517150408.3411044-1-peterx@redhat.com> <20230517150408.3411044-2-peterx@redhat.com> <4a68aee6-68d9-4d17-bb7f-cda3910f6f1f@lucifer.local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Stat-Signature: 7sgwkmo9j1bpyyejuzo7feoqg3acuieu X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 62C2D40014 X-Rspam-User: X-HE-Tag: 1684348863-842048 X-HE-Meta: U2FsdGVkX19ZGBIHDCZeHO/0UhoemA1hKsxV2o6DDmtHPB+LwpAJ/UEDQqTTflt62FbFwRi0q5/TL0NYAH3by4kILbMs/LIccR1d+3tJ5k/W/ZVH1nfDPdTl5JxjGb+rrC5ybQ0X4FttV43Bam6R2dj7R9SpOqT+zn0+38PQL2y5ekQDvwh5jjrqf668qPRrNA29PcXeA6EJhv2y+06jMwDQCgsEx4fG/hJsSC4iLsMjuToUfJoTpgAME0vCCt3rHnaIWn9sW3gvPAGvlkFrfMx+nqfyiNvC8xiFTn9ZFMomCgEejkNjLD3YnplqWI5rfc2VHnn6BHVQqdZ9fm0+JLuJ5XWMZ+gQ9oZUnCU8SSO79OWus/4t+qR7EQD6pG836EtcDtyjwSiteMAcGyTXYrlLV8TMViZEA0gRsU4b2LqKhegMBT9GHPlariSwr6FvKG6/A8bHnUVf076Ksd3b+AQ0c+WCkGM/0S8A6bYAI5mQV62W5U7W5W6zsq3w0LrqUBShRqSB2MAmipKsW8KlNzvVDzeQRGOFkvoc+RsNtdf0hfQB2aKoAdLF67nu/Yicf0Iv9OIDttIewM7AlpNb6YIlZT/jEQA0KB7iZiQAMx2GmviW0mRPrkNlNSqen0QK/jCXn5TMirtDICJwg6ELLuO/FSpjPZFkHvtGhaeKWJAwqf+dKCMnZ5KvOwGZDYgpBCbZYcUm2KpcrBkBLo4R5y9h8iRAX6S4tDFAvvgYTjPML28tUm+WHC0jP9z/XUP45gI2xReJRmEfAKIceb71ti7RW7sOiOkOrI+BOig9Lju6XSApi5fNHosoihBJkXgh+OJkOFih2Y2N0y4pjiDCPUZuKVqg1vEVw7ZouySosThVveUDtdfLrkosa2wQNODODW9ZZqPKL3g1H7dz8IDB/cxpj8QmsA7xS4KQdqdsMTX1bbukTVYfBzG9rkNgBxpOhKMgx3Wf4Hm/5OCFoey HlasEIFY TCpYQVE3KfxcwRvWwvBComSlruguQWE7J7o5B1rmI/sjNXxk2Kmj2cxnUWJtO5exWxQEQuhnNahmWrhsVrYnqeGSFeFvnmbJDYepg5dvEn6PYauVy2os06EZIjD0NIp+GUXDXmHhY569WZN3L7euobXqKlAJI/21xRavkwWQGGYAr4mj7Pcfg6Ykm52O2GFuBV6NlORaNWg5fPU9qzLxoG83cd6sBdPqan1sVHyYR4rN43fFIHtExeYqYk60pldbGGGmbCylBlY3CSyBZ6Mm9J1TzUkXYafyHIqESG1nmq9L1XfGb3sHMs5AHhhcP76wvDQHZrh4NDQGWwrVV7wByHIhHkdd6Zuhgm/Kt5wfoPjuzBg/KnyJLwE1/4YDGsS5FQ6wLndlKgtJsaVyDvrLwvrH2AGgSTF8/A4izDSPTRh8WZCqdaiPaiRCf5eCet1sfir1PIbGBFNv8qnh9bsQFI0LoEwbL2GAtNy3DlPapaqeUG5iwYTyoijm7zDgOUmqeQuU8mmtit3q0xEsRPD4xlwD3n3WyN07gnne8 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, May 17, 2023 at 02:37:41PM -0400, Peter Xu wrote: > On Wed, May 17, 2023 at 06:20:55PM +0100, Lorenzo Stoakes wrote: > > On Wed, May 17, 2023 at 11:04:07AM -0400, Peter Xu wrote: > > > It seems vma merging with uffd paths is broken with either > > > register/unregister, where right now we can feed wrong parameters to > > > vma_merge() and it's found by recent patch which moved asserts upwards in > > > vma_merge() by Lorenzo Stoakes: > > > > > > https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ > > > > > > The problem is in the current code base we didn't fixup "prev" for the case > > > where "start" address can be within the "prev" vma section. In that case > > > we should have "prev" points to the current vma rather than the previous > > > one when feeding to vma_merge(). > > > > This doesn't seem quite correct, perhaps - "where start is contained within vma > > but not clamped to its start. We need to convert this into case 4 which permits > > subdivision of prev by assigning vma to prev. As we loop, each subsequent VMA > > will be clamped to the start." > > I think it covers more than case 4 - it can also be case 0 where no merge > will happen? Ugh please let's not call a case that doesn't merge by a number :P but sure of course it might also not merge. > > > > > > > > > This patch will eliminate the report and make sure vma_merge() calls will > > > become legal again. > > > > > > One thing to mention is that the "Fixes: 29417d292bd0" below is there only > > > to help explain where the warning can start to trigger, the real commit to > > > fix should be 69dbe6daf104. Commit 29417d292bd0 helps us to identify the > > > issue, but unfortunately we may want to keep it in Fixes too just to ease > > > kernel backporters for easier tracking. > > > > > > Cc: Lorenzo Stoakes > > > Cc: Mike Rapoport (IBM) > > > Cc: Liam R. Howlett > > > Reported-by: Mark Rutland > > > Fixes: 29417d292bd0 ("mm/mmap/vma_merge: always check invariants") > > > Fixes: 69dbe6daf104 ("userfaultfd: use maple tree iterator to iterate VMAs") > > > Closes: https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ > > > Cc: linux-stable > > > Signed-off-by: Peter Xu > > > --- > > > fs/userfaultfd.c | 5 +++++ > > > 1 file changed, 5 insertions(+) > > > > > > diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c > > > index 0fd96d6e39ce..17c8c345dac4 100644 > > > --- a/fs/userfaultfd.c > > > +++ b/fs/userfaultfd.c > > > @@ -1459,6 +1459,8 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, > > > > > > vma_iter_set(&vmi, start); > > > prev = vma_prev(&vmi); > > > + if (vma->vm_start < start) > > > + prev = vma; > > > > > > ret = 0; > > > for_each_vma_range(vmi, vma, end) { > > > @@ -1625,6 +1627,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, > > > > > > vma_iter_set(&vmi, start); > > > prev = vma_prev(&vmi); > > > + if (vma->vm_start < start) > > > + prev = vma; > > > + > > > ret = 0; > > > for_each_vma_range(vmi, vma, end) { > > > cond_resched(); > > > -- > > > 2.39.1 > > > > > > > Other than that looks good:- > > > > Reviewed-by: Lorenzo Stoakes > > Thanks to both on the quick reviews! No problem! > > -- > Peter Xu >