From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C18C8C433FE for ; Mon, 28 Nov 2022 22:10:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C293F6B0071; Mon, 28 Nov 2022 17:10:34 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id BD9F96B0072; Mon, 28 Nov 2022 17:10:34 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AA1AB6B0073; Mon, 28 Nov 2022 17:10:34 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 97B066B0071 for ; Mon, 28 Nov 2022 17:10:34 -0500 (EST) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 67C5C160C2F for ; Mon, 28 Nov 2022 22:10:34 +0000 (UTC) X-FDA: 80184245988.18.63C7CF9 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by imf18.hostedemail.com (Postfix) with ESMTP id 07E661C000E for ; Mon, 28 Nov 2022 22:10:33 +0000 (UTC) Received: by mail-pf1-f173.google.com with SMTP id w79so11893152pfc.2 for ; Mon, 28 Nov 2022 14:10:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=WQ1MDRW1e7gVGBgFgV8gW3QkC9WMZddxzT1WNY3Uo4I=; b=CAQUbiNJicl7IXT9VbNf06kK+1kweVcWbM161FF+QmwTQY+Kb5Wbo4aDrG0xE624ea At5gqb2RPP+Xs2x0oZp0WgbY1Qfm2JX8ibf5a+SXz4FB6XrbW9wEdDc+aiDuERjx9cag Sye31QhoC5MSuhoyFtKFevf2GTpQMRbcOQazEVIEQrMy6EyRrncl56EZVlk9ftPLOuwu EPK8N3kQCGUmW+v73jA6zRCgpkIw5G29Phxp4fyslDvidAIiZcw1tp7X703kbDVR65mD n5JquNcqqCCTKXykeld0eVnFOddCqKJXAqN9eQaaL4/Dzj2uSbPsZvqLPyDmbTcxAbsa KRng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=WQ1MDRW1e7gVGBgFgV8gW3QkC9WMZddxzT1WNY3Uo4I=; b=i7XXyod/UjD5jkkJtNVcxC7e+VXsuZ31Mnj5jGPiCoDCvzEpktjhOVjF6CQjyra9zD zCfFYnjFBi1fwD58TAp18XdJXYMSZbAfPNc/ko00e15XDNgtDVG1s1EGuvsQEeFa6nHR wM2y4ve4PLAPQU77JGY4ac9Epe70oo2d9WQgvYGVf5YjBoahgwCDadL+oX3dAe3U0tXF ko7o1QYBH2NQwxjLX0riV5PkfYPkCw2T8GqoJXYLa3tPX4q9Q1MYiJsdDmQUb20iNNSU a95EaGnZJQO2/D+rbsrBGum7oOfueA6SRS8EtV7UiVyA36kVRSMDZNShBO8i1Aj5F3/F 0iZQ== X-Gm-Message-State: ANoB5pnr3kSVp1dU3I7hsG74DSP4jlVo7blxMiZX/mzLCDASXnI4/Ruz c37QdDogxE46oZRC8+2Ge62kjQbxNUfrVYB+ma8= X-Google-Smtp-Source: AA0mqf753EeprsV+YMXIdjS74J0i/eVFqu/EUcs9H4EwXK6tutlx4ij9IbZPCnOWahICuyyi1c85w3bmP0t43DF/hD0= X-Received: by 2002:a63:225d:0:b0:477:beb8:70f8 with SMTP id t29-20020a63225d000000b00477beb870f8mr23454969pgm.281.1669673432639; Mon, 28 Nov 2022 14:10:32 -0800 (PST) MIME-Version: 1.0 References: <20221128180252.1684965-1-jannh@google.com> <20221128180252.1684965-2-jannh@google.com> In-Reply-To: From: Yang Shi Date: Mon, 28 Nov 2022 14:10:21 -0800 Message-ID: Subject: Re: [PATCH v4 2/3] mm/khugepaged: Fix GUP-fast interaction by sending IPI To: Jann Horn Cc: security@kernel.org, Andrew Morton , David Hildenbrand , Peter Xu , John Hubbard , linux-kernel@vger.kernel.org, linux-mm@kvack.org Content-Type: text/plain; charset="UTF-8" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1669673434; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=WQ1MDRW1e7gVGBgFgV8gW3QkC9WMZddxzT1WNY3Uo4I=; b=K8OSlRJ1k6taw9jfwIyC4WcLaaO7dgFvGMjkQEGZ81fYSpYRRIZ+8Ou5dprLuo+4k3wawd ZaA2O2MxxJrkfLYvOIyES/mr7Pp7OkrQUWRo8R1I4o8vipiIlTQBqUwJKmrTI8J6VNsINx WUqvvAVc2GmY0MExodLYaR4pRbtx/DA= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=CAQUbiNJ; spf=pass (imf18.hostedemail.com: domain of shy828301@gmail.com designates 209.85.210.173 as permitted sender) smtp.mailfrom=shy828301@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1669673434; a=rsa-sha256; cv=none; b=kqE+l1CQhU4K6iiuQ/JBSJVyyKZ8qp9Q3cdly8x/IMY/Q9Ug6odTPDhlUGd0rNnev6+Y3P NWVuPWeCccIVocoPTyfu6Khr06rINc4YLImaPepdXTPJytiUYFT7+leI16t9VgKlrxCRxV t3owAwjXA+5AMuc6ZSqwf0m7MeD2JlQ= X-Stat-Signature: duj81czprggkbsz6rzpsqgu16xgq3j65 X-Rspam-User: X-Rspamd-Queue-Id: 07E661C000E X-Rspamd-Server: rspam11 Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=CAQUbiNJ; spf=pass (imf18.hostedemail.com: domain of shy828301@gmail.com designates 209.85.210.173 as permitted sender) smtp.mailfrom=shy828301@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-HE-Tag: 1669673433-400274 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Nov 28, 2022 at 12:12 PM Jann Horn wrote: > > On Mon, Nov 28, 2022 at 9:10 PM Yang Shi wrote: > > On Mon, Nov 28, 2022 at 11:57 AM Jann Horn wrote: > > > > > > On Mon, Nov 28, 2022 at 8:54 PM Yang Shi wrote: > > > > > > > > On Mon, Nov 28, 2022 at 10:03 AM Jann Horn wrote: > > > > > > > > > > Since commit 70cbc3cc78a99 ("mm: gup: fix the fast GUP race against THP > > > > > collapse"), the lockless_pages_from_mm() fastpath rechecks the pmd_t to > > > > > ensure that the page table was not removed by khugepaged in between. > > > > > > > > > > However, lockless_pages_from_mm() still requires that the page table is not > > > > > concurrently freed or reused to store non-PTE data. Otherwise, problems > > > > > can occur because: > > > > > > > > > > - deposited page tables can be freed when a THP page somewhere in the > > > > > mm is removed > > > > > - some architectures store non-PTE information inside deposited page > > > > > tables (see radix__pgtable_trans_huge_deposit()) > > > > > > > > > > Additionally, lockless_pages_from_mm() is also somewhat brittle with > > > > > regards to page tables being repeatedly moved back and forth, but > > > > > that shouldn't be an issue in practice. > > > > > > > > > > Fix it by sending IPIs (if the architecture uses > > > > > semi-RCU-style page table freeing) before freeing/reusing page tables. > > > > > > > > > > As noted in mm/gup.c, on configs that define CONFIG_HAVE_FAST_GUP, > > > > > there are two possible cases: > > > > > > > > > > 1. CONFIG_MMU_GATHER_RCU_TABLE_FREE is set, causing > > > > > tlb_remove_table_sync_one() to send an IPI to synchronize with > > > > > lockless_pages_from_mm(). > > > > > 2. CONFIG_MMU_GATHER_RCU_TABLE_FREE is unset, indicating that all > > > > > TLB flushes are already guaranteed to send IPIs. > > > > > tlb_remove_table_sync_one() will do nothing, but we've already > > > > > run pmdp_collapse_flush(), which did a TLB flush, which must have > > > > > involved IPIs. > > > > > > > > I'm trying to catch up with the discussion after the holiday break. I > > > > understand you switched from always allocating a new page table page > > > > (we decided before) to sending IPIs to serialize against fast-GUP, > > > > this is fine to me. > > > > > > > > So the code now looks like: > > > > pmdp_collapse_flush() > > > > sending IPI > > > > > > > > But the missing part is how we reached "TLB flushes are already > > > > guaranteed to send IPIs" when CONFIG_MMU_GATHER_RCU_TABLE_FREE is > > > > unset? ARM64 doesn't do it IIRC. Or did I miss something? > > > > > > From arch/arm64/Kconfig: > > > > > > select MMU_GATHER_RCU_TABLE_FREE > > > > > > CONFIG_MMU_GATHER_RCU_TABLE_FREE is not a config option that the user > > > can freely toggle; it is an option selected by the architecture. > > > > Aha, I see :-) BTW, shall we revert "mm: gup: fix the fast GUP race > > against THP collapse"? It seems not necessary anymore if this approach > > is used IIUC. > > Yeah, I agree. Since this patch could solve two problems: the use-after-free of the data page (pinned by fast-GUP) and the page table page and my patch will be reverted, so could you please catch both issues in this patch's commit log? I'd like to preserve the description of the issue fixed by my patch. I think that it is helpful to see the information about all the fixed problems in one commit instead of digging into another reverted commit. > > > Reviewed-by: Yang Shi > > Thanks!