From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49B85C83F09 for ; Tue, 8 Jul 2025 16:35:03 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E25596B0095; Tue, 8 Jul 2025 12:35:02 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DD5BC6B0098; Tue, 8 Jul 2025 12:35:02 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CEB756B0099; Tue, 8 Jul 2025 12:35:02 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id BEA916B0095 for ; Tue, 8 Jul 2025 12:35:02 -0400 (EDT) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 691C21606D2 for ; Tue, 8 Jul 2025 16:35:02 +0000 (UTC) X-FDA: 83641646844.25.74DA322 Received: from mail-qt1-f169.google.com (mail-qt1-f169.google.com [209.85.160.169]) by imf01.hostedemail.com (Postfix) with ESMTP id 8156C4000D for ; Tue, 8 Jul 2025 16:35:00 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=Eaxdq7cn; spf=pass (imf01.hostedemail.com: domain of surenb@google.com designates 209.85.160.169 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1751992500; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=lyPVyPZ7g8sae8dggze/O0X+T0IkRpg9KIq+ZglFhHY=; b=L5L2Nj2hjsRkpHY++L1WOZing7ad/N9yNbvGoxjNETJS6Xmr3YOsi8b9sSklcVsPtival7 JGBfvVjnkz9EZJyrZ9vai47JAaKPxsJx7wfitDq9sMINYB8vFPmjyJIONUPu8/eTf3v7bK 2P1EsMgs5TdnLj/eOcnzgwman8lrt4k= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=Eaxdq7cn; spf=pass (imf01.hostedemail.com: domain of surenb@google.com designates 209.85.160.169 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1751992500; a=rsa-sha256; cv=none; b=lYG6a7ri/CGSa/yEMHAl7JoZYYZalGLuvBbU1Sg5cTAIKhyN/bCAmqcC/bVdM/0mCs8M03 VuU+6x9zRu0HA4O8x6xdtK7Cl4MiK5NkjYIfktTBDROC8KVfYaPp0kBT4dhCpCFK2RZFiO 01uo0XyL3V+V9WkKy8Baj8HaSknEZ8A= Received: by mail-qt1-f169.google.com with SMTP id d75a77b69052e-4a5ac8fae12so4491cf.0 for ; Tue, 08 Jul 2025 09:35:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1751992499; x=1752597299; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=lyPVyPZ7g8sae8dggze/O0X+T0IkRpg9KIq+ZglFhHY=; b=Eaxdq7cnjwkBiSbBD0MjeFJtYcEfL9+ZDjEVU9PZ4AS65P0d9mCKs6mQj1rACqTq2P 9sERqsFjn1JbhgcAJkfOoPdWHl0ZwD+RVCyZMkxhRa2l4GpLqV0w271xMWy426OhKhcM a4RbF57r8nZD0kzhOzY4kVPGo4DAF1AEzmbp55JZkJHf692xvSYdoeihqjmKfHjQl0EB o80NCi+hpqC52NrfrtLPs+uF/t8/tieX931Cm0IEy1oM0CGHHuskw/AECb2jo6gNt2fC Vz5gJvajcCtnYEiTqLP25meUgUFlaBPUN30Fmdxm7ObMr76B92SqF2LminWEciwERrP8 LNRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1751992499; x=1752597299; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lyPVyPZ7g8sae8dggze/O0X+T0IkRpg9KIq+ZglFhHY=; b=AuM2dyqfhSdT1M6XIGcSyT4EQNN35dzix4oaTk7Ry3FZR/mjeM/zHKrAV8FOKYp+RE 7sWbAfTQWfVAUZ+n7BH00r6Y1nH+b4lgV/dzGvextOjAJ2gfXanWply7kIepcdMBOzKN neIW8vYNFqgtN3W1tCHgUH9+kweelCryj5OjuKB+lwLPMskHKxWNpexOg/fUTRtPuOIo fnDKx0IQ6I2uYHK20ufZnJKnsfqO/tnrms6fpqcVBoXlvh6ej0V6TrQaNQA071dKrnmx ssBBT4qZaRvC3EoPcU0JlNghLudtw5cvKE0/tpakA+Zpyt0E4Ldh2W8ZXaZtk36CJAsz W04g== X-Forwarded-Encrypted: i=1; AJvYcCWxsQNsjCUP5HzuvaVPsm+WNLaSF5L3ZI+g8ezrELbAi+Joy/zE0NL47IRnKsVVK0xuWQyenpj35g==@kvack.org X-Gm-Message-State: AOJu0Yw82ft7IkIcOxLYxeiFLR+spY4i9Giw25UvEjuWl5fXzJLjGYt6 54pOR/5ykMKo+B2fU6VXAQh+CC7YJ1eF9HxO2A0gLecs/V32eye2u08+Kw7mNDyUyIjqB7QG14v 2jlAfVdJJ1SChEE9tdjDKuFlfnMBY6m+GYcHmCjOqgcVgHJov1KBP8cN2Vxk= X-Gm-Gg: ASbGnctFE5qF4VN7lnXfcpYXSVdxyFlZrlHwV80TO0j/1tUgvGWdBezu5SnnKYOy1hb u31QuirhApJPT2/pwjZYhPylxCtwrBlrVaXhFvoQQKfHWRw2hcLI1dezMdhJbJleOnXidIqMnP5 kAqD38gyKYNCKMp9GfZU/DsM1FRaWOKqZswCmk1ot0fVi6y3MjNnc9xH8sJFhrhhOA4TaE/ziFC w== X-Google-Smtp-Source: AGHT+IEh67BPddDPTFD/tfb4fSwiCqr0a9Zn5VVe9gpDL/kfIfnog3VmVjGUueJWQ9mX4X2FFYYG425DMTQCtZmeDdo= X-Received: by 2002:a05:622a:738b:b0:4a9:a4ef:35d3 with SMTP id d75a77b69052e-4a9d4701facmr2137511cf.7.1751992499047; Tue, 08 Jul 2025 09:34:59 -0700 (PDT) MIME-Version: 1.0 References: <20250630031958.1225651-1-sashal@kernel.org> <20250630175746.e52af129fd2d88deecc25169@linux-foundation.org> In-Reply-To: From: Suren Baghdasaryan Date: Tue, 8 Jul 2025 09:34:48 -0700 X-Gm-Features: Ac12FXzzSrrvF71LQqsCA0KSGYduhbXVbeZdy5-T37l-FdsQQhzkvZIbKhxe_qE Message-ID: Subject: Re: [PATCH] mm/userfaultfd: fix missing PTE unmap for non-migration entries To: Sasha Levin Cc: David Hildenbrand , Andrew Morton , peterx@redhat.com, aarcange@redhat.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Queue-Id: 8156C4000D X-Rspamd-Server: rspam09 X-Stat-Signature: jw1sfwx78xphb6zyofo9973gia9yshk9 X-HE-Tag: 1751992500-438138 X-HE-Meta: U2FsdGVkX1+TMAgTVHJV4AMsP6qvj/xBoqnfwziF9Mrcq/4G2xpm+hqYLw9QSPKPJPFakVEo09hcEZNVZddDvAWdTeG3wDUdE1wVBueRTnd/tmrBGuqRoToRLzl+y5SuG9fH1lk0gVJHVlP02aHkUyEGLLSfUMMQWI9quCmyh30jfet61H0obdoA4mHL6uUTxrBAcYm1VyHPtVpIvOqjYZ9f+Y1KU74sI55rFFj6nVWUkAx7xNYevXyjNBr0y0p3ut9xRC51q3M1vEPzfiekNv4K3Z2e7Sx70wnAacwvQauUIhupxGwP9cwcyNe5fetERDSGFOa4PGrOR6YhcUnBYRmv2TQA2EXkT5n4ErP53zuxes3lD5zqzMEDzO5MtrGZkf/BHweHwn4UrLtzHI+EXZn0Pns3qtKhRlCGGVNIK7qAAcfiD5Ep7/KadXnzMJCcRcqmxf/VRhL2RF9AmGgJe7tGNFTNzsuYmwhzVG2h1Sz/lNwnZnoEtGXCAsK6ww8WMEmnfqUmMA3fyeurhhyOyh/BtoUKeMJ105vwC9nQyzsQaYt0DcjzkfJb94D8V05rVBt04a/2coLk98fw6BtCxWuNKbbiNMzN6dkOk8GdU0LHWLup7ztgP+BZikqsHyRN1NfxV0lBEPCQUjO3AbC+8FUXu2vRere9JzHuAMy8TOU3Q4NOiaR+i0ikgqdNLQ3FJighXCla5ICW1cnUcPUUqu196JCNM6jsjeaitvgJxVmbM83gRdCNN2pHTIpXOVqPM/DLMxEK5k/4dJuHhqu+il9ZqLuAWtADJDGV+viOqW4te89OokH7dh5ss3sLrpRrrx4NAmJwSCgnkLCKNha17sEeZW5IDrlXR8cYsiJxcql5zH8yEZZEIpxfgojTgQpGEEAlvZyC6rR9bbE0N7+XwSZ7udJrb7amC0Pc/q/WHmG7mboGetpKanj5pGEuHoqlLUYWi9at+HcHXJ0/dMQ EcemDd1t jvFsm7MBDKpUN1iek0Igg/xqh2ZdMFf8LrGVXCI4Fg8i5hqarMZIuU9R4e5Y3iWzcfL5ejD8NkV9d8JnBjd002tYpFXfTLFcdWfVXYTQk1r44uhNAkdEld0qqHvZUq3U0y5KQGlF7Ecd4W0FfwPbexe8gM7oMxjmBg+Wzyf10BVfWmQy/4oo7SLyTPOyz9xqNRh6j+YHqFrhamHSk0d3fYN2TI3oqbRezBD35eD65U55eiznpY1OkMDvEF/3IeFf14leokCoMcLIMNHA7X4StzjH9Yytrdu0HBlhuM8S8WhkbvXF8YMvxGqWIRtqi0ZV+4D6lMtIwavzbUVJOJOJOkDVyUTdSxFaS99sA33j5eWTOo6bT0JmH1Vlx/Kh4VpXfu104Ml/ZwQYiXoU= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Jul 8, 2025 at 8:57=E2=80=AFAM Sasha Levin wrot= e: > > On Tue, Jul 08, 2025 at 08:39:47AM -0700, Suren Baghdasaryan wrote: > >On Tue, Jul 8, 2025 at 8:33=E2=80=AFAM Sasha Levin w= rote: > >> > >> On Tue, Jul 08, 2025 at 05:10:44PM +0200, David Hildenbrand wrote: > >> >On 01.07.25 02:57, Andrew Morton wrote: > >> >>On Sun, 29 Jun 2025 23:19:58 -0400 Sasha Levin w= rote: > >> >> > >> >>>When handling non-swap entries in move_pages_pte(), the error handl= ing > >> >>>for entries that are NOT migration entries fails to unmap the page = table > >> >>>entries before jumping to the error handling label. > >> >>> > >> >>>This results in a kmap/kunmap imbalance which on CONFIG_HIGHPTE sys= tems > >> >>>triggers a WARNING in kunmap_local_indexed() because the kmap stack= is > >> >>>corrupted. > >> >>> > >> >>>Example call trace on ARM32 (CONFIG_HIGHPTE enabled): > >> >>> WARNING: CPU: 1 PID: 633 at mm/highmem.c:622 kunmap_local_indexe= d+0x178/0x17c > >> >>> Call trace: > >> >>> kunmap_local_indexed from move_pages+0x964/0x19f4 > >> >>> move_pages from userfaultfd_ioctl+0x129c/0x2144 > >> >>> userfaultfd_ioctl from sys_ioctl+0x558/0xd24 > >> >>> > >> >>>The issue was introduced with the UFFDIO_MOVE feature but became mo= re > >> >>>frequent with the addition of guard pages (commit 7c53dfbdb024 ("mm= : add > >> >>>PTE_MARKER_GUARD PTE marker")) which made the non-migration entry c= ode > >> >>>path more commonly executed during userfaultfd operations. > >> >>> > >> >>>Fix this by ensuring PTEs are properly unmapped in all non-swap ent= ry > >> >>>paths before jumping to the error handling label, not just for migr= ation > >> >>>entries. > >> >> > >> >>I don't get it. > >> >> > >> >>>--- a/mm/userfaultfd.c > >> >>>+++ b/mm/userfaultfd.c > >> >>>@@ -1384,14 +1384,15 @@ static int move_pages_pte(struct mm_struct = *mm, pmd_t *dst_pmd, pmd_t *src_pmd, > >> >>> entry =3D pte_to_swp_entry(orig_src_pte); > >> >>> if (non_swap_entry(entry)) { > >> >>>+ pte_unmap(src_pte); > >> >>>+ pte_unmap(dst_pte); > >> >>>+ src_pte =3D dst_pte =3D NULL; > >> >>> if (is_migration_entry(entry)) { > >> >>>- pte_unmap(src_pte); > >> >>>- pte_unmap(dst_pte); > >> >>>- src_pte =3D dst_pte =3D NULL; > >> >>> migration_entry_wait(mm, src_pmd, src_= addr); > >> >>> err =3D -EAGAIN; > >> >>>- } else > >> >>>+ } else { > >> >>> err =3D -EFAULT; > >> >>>+ } > >> >>> goto out; > >> >> > >> >>where we have > >> >> > >> >>out: > >> >> ... > >> >> if (dst_pte) > >> >> pte_unmap(dst_pte); > >> >> if (src_pte) > >> >> pte_unmap(src_pte); > >> > > >> >AI slop? > >> > >> Nah, this one is sadly all me :( > >> > >> I was trying to resolve some of the issues found with linus-next on > >> LKFT, and misunderstood the code. Funny enough, I thought that the > >> change above "fixed" it by making the warnings go away, but clearly is > >> the wrong thing to do so I went back to the drawing table... > >> > >> If you're curious, here's the issue: https://qa-reports.linaro.org/lkf= t/sashal-linus-next/build/v6.13-rc7-43418-g558c6dd4d863/testrun/29030370/su= ite/log-parser-test/test/exception-warning-cpu-pid-at-mmhighmem-kunmap_loca= l_indexed/details/ > > > >Any way to symbolize that Call trace? I can't find build artefacts to > >extract vmlinux image... > > The build artifacts are at > https://storage.tuxsuite.com/public/linaro/lkft/builds/2zSrTao2x4P640QKIx= 18JUuFdc1/ > but I couldn't get it to do the right thing. I'm guessing that I need > some magical arm32 toolchain bits that I don't carry: > > cat tr.txt | ./scripts/decode_stacktrace.sh vmlinux > <4>[ 38.566145] ------------[ cut here ]------------ > <4>[ 38.566392] WARNING: CPU: 1 PID: 637 at mm/highmem.c:622 kunmap_local= _indexed+0x198/0x1a4 > <4>[ 38.569398] Modules linked in: nfnetlink ip_tables x_tables > <4>[ 38.570481] CPU: 1 UID: 0 PID: 637 Comm: uffd-unit-tests Not tainte= d 6.16.0-rc4 #1 NONE > <4>[ 38.570815] Hardware name: Generic DT based system > <4>[ 38.571073] Call trace: > <4>[ 38.571239] unwind_backtrace from show_stack (arch/arm64/kernel/stack= trace.c:465) > <4>[ 38.571602] show_stack from dump_stack_lvl (lib/dump_stack.c:118 (dis= criminator 1)) > <4>[ 38.571805] dump_stack_lvl from __warn (kernel/panic.c:791) > <4>[ 38.572002] __warn from warn_slowpath_fmt+0xa8/0x174 > <4>[ 38.572290] warn_slowpath_fmt from kunmap_local_indexed+0x198/0x1a4 > <4>[ 38.572520] kunmap_local_indexed from move_pages_pte+0xc40/0xf48 > <4>[ 38.572970] move_pages_pte from move_pages+0x428/0x5bc > <4>[ 38.573189] move_pages from userfaultfd_ioctl+0x900/0x1ec0 > <4>[ 38.573376] userfaultfd_ioctl from sys_ioctl+0xd24/0xd90 > <4>[ 38.573581] sys_ioctl from ret_fast_syscall+0x0/0x5c > <4>[ 38.573810] Exception stack(0xf9d69fa8 to 0xf9d69ff0) > <4>[ 38.574546] 9fa0: 00001000 00000005 00000005 c028= aa05 b2d3ecd8 b2d3ecc8 > <4>[ 38.574919] 9fc0: 00001000 00000005 b2d3ece0 00000036 b2d3ed84 b2d3= ed50 b2d3ed7c b2d3ed58 > <4>[ 38.575131] 9fe0: 00000036 b2d3ecb0 b6df1861 b6d5f736 > <4>[ 38.575511] ---[ end trace 0000000000000000 ]--- Ah, I know what's going on. 6.13.rc7 which is used in this test does not have my fix 927e926d72d9 ("userfaultfd: fix PTE unmapping stack-allocated PTE copies") (see https://elixir.bootlin.com/linux/v6.13.7/source/mm/userfaultfd.c#L1284). It was backported into 6.13.rc8. So, it tries to unmap a copy of a mapped PTE, which will fail when CONFIG_HIGHPTE is enabled. So, it makes sense that it is failing on arm32. > > -- > Thanks, > Sasha