From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.2 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF13CC433E6 for ; Wed, 23 Dec 2020 10:06:37 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7BB1922475 for ; Wed, 23 Dec 2020 10:06:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7BB1922475 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A1A7E8D0007; Wed, 23 Dec 2020 05:06:36 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 9CAD38D0001; Wed, 23 Dec 2020 05:06:36 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8BA288D0007; Wed, 23 Dec 2020 05:06:36 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0077.hostedemail.com [216.40.44.77]) by kanga.kvack.org (Postfix) with ESMTP id 7925C8D0001 for ; Wed, 23 Dec 2020 05:06:36 -0500 (EST) Received: from smtpin09.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 40D0E3633 for ; Wed, 23 Dec 2020 10:06:36 +0000 (UTC) X-FDA: 77624117592.09.man49_4b1085927467 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin09.hostedemail.com (Postfix) with ESMTP id 25BC5180AD830 for ; Wed, 23 Dec 2020 10:06:36 +0000 (UTC) X-HE-Tag: man49_4b1085927467 X-Filterd-Recvd-Size: 6890 Received: from mail-io1-f53.google.com (mail-io1-f53.google.com [209.85.166.53]) by imf05.hostedemail.com (Postfix) with ESMTP for ; Wed, 23 Dec 2020 10:06:35 +0000 (UTC) Received: by mail-io1-f53.google.com with SMTP id p187so14636077iod.4 for ; Wed, 23 Dec 2020 02:06:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=TsZfeXRM1ReVd7eBjQcIMfaYnF6JpJXqu5pz2p0wGEQ=; b=CNmoLodAEpv7gOwb8VpGyiCO30xoo2vCseCl7Eji3i9ZVItKzd5J+ZHmP4Q90yW9SF v9/P4uSVz7jVdIkY/Q7aJORA3LOHdltQkbnFMryoxugSt3lIs3VvpBheK+VoEHaroXxq GrILcIEPhED0FYieTZbeY6px2c/7Y+7nHdeWGGqdoSpqu0F+ojsemeGhHiIY8iO5KauO vYeFCrHb+nlpRHSDYs+V3QZIxHwep2HohggzXgELErQKjWM2g8p/N9RjYIY+sOMCzknf W/tq16osSog5ItcqmtldMo0KTddd4OEAdZzG2SgrPWKfdkqAfUfij21WlwmTwR4h8ro5 yNXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=TsZfeXRM1ReVd7eBjQcIMfaYnF6JpJXqu5pz2p0wGEQ=; b=SZNwiRVb9qoRdPoInHw80TcIhuJQ6phiuDhVB5FqJSbeVfmmCvW+Bk65kAvo7qJYmz CRiBfHGybANeuXlhWnT4zUiETi9jUOFR7DHmJxm7z34093sGYhgk+h2cRDL3T6VqtX73 Rs7waL55tpWc1wsfeiPs6YXa6x7g3iSrX2myWIN8i0zXYKpPkJYrWRq3X4OOtciWAB7X eq8Ltj5T/+oRfqB0CQtlIpZIjyFy29SFnmuZ02TVLeS7FIiUu35TG0wE4NhFP3iPUfM7 pG11a0uNPZbR+ZZqFi/WQC0RCw/gsdFRe4i0aayo/9dMWlAI70/P4wpa1FGOxql6EK6W aeDg== X-Gm-Message-State: AOAM532qvXArjF7ce/1lLZCRz+aPRNGIDRu3Xcs1YIK9zv7sRzpQaqPZ E6DOFc3qToYTpArl25MBR2ltJw== X-Google-Smtp-Source: ABdhPJzBINtZwYQUDT2fyB7vaQAbu2xabNp/ZkzWZgkh5VIkMKAYi1A0wfAjRz9FwcP8I8BS4yHZEQ== X-Received: by 2002:a05:6602:387:: with SMTP id f7mr21085021iov.209.1608717994800; Wed, 23 Dec 2020 02:06:34 -0800 (PST) Received: from google.com ([2620:15c:183:200:7220:84ff:fe09:2d90]) by smtp.gmail.com with ESMTPSA id 12sm17304825ily.42.2020.12.23.02.06.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Dec 2020 02:06:34 -0800 (PST) Date: Wed, 23 Dec 2020 03:06:30 -0700 From: Yu Zhao To: Linus Torvalds Cc: Andrea Arcangeli , Andy Lutomirski , Peter Xu , Nadav Amit , linux-mm , lkml , Pavel Emelyanov , Mike Kravetz , Mike Rapoport , stable , Minchan Kim , Will Deacon , Peter Zijlstra Subject: Re: [PATCH] mm/userfaultfd: fix memory corruption due to writeprotect Message-ID: References: <20201221223041.GL6640@xz-x1> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Dec 23, 2020 at 01:44:42AM -0800, Linus Torvalds wrote: > On Tue, Dec 22, 2020 at 4:01 PM Linus Torvalds > wrote: > > > > The more I look at the mprotect code, the less I like it. We seem to > > be much better about the TLB flushes in other places (looking at > > mremap, for example). The mprotect code seems to be very laissez-faire > > about the TLB flushing. > > No, this doesn't help. > > > Does adding a TLB flush to before that > > > > pte_unmap_unlock(pte - 1, ptl); > > > > fix things for you? > > It really doesn't fix it. Exactly because - as pointed out earlier - > the actual page *copy* happens outside the pte lock. I appreciate all the pointers. It seems to me it does. > So what can happen is: > > - CPU 1 holds the page table lock, while doing the write protect. It > has cleared the writable bit, but hasn't flushed the TLB's yet > > - CPU 2 did *not* have the TLB entry, sees the new read-only state, > takes a COW page fault, and reads the PTE from memory (into > vmf->orig_pte) In handle_pte_fault(), we lock page table and check pte_write(), so we either see a RW pte before CPU 1 runs or a RO one with no stale tlb entries after CPU 1 runs, assume CPU 1 flushes tlb while holding the same page table lock (not mmap_lock). > - CPU 2 correctly decides it needs to be a COW, and copies the page contents > > - CPU 3 *does* have a stale TLB (because TLB invalidation hasn't > happened yet), and writes to that page in users apce > > - CPU 1 now does the TLB invalidate, and releases the page table lock > > - CPU 2 gets the page table lock, sees that its PTE matches > vmf->orig_pte, and switches it to be that writable copy of the page. > > where the copy happened before CPU 3 had stopped writing to the page. > > So the pte lock doesn't actually matter, unless we actually do the > page copy inside of it (on CPU2), in addition to doing the TLB flush > inside of it (on CPU1). > > mprotect() is actually safe for two independent reasons: (a) it does > the mmap_sem for writing (so mprotect can't race with the COW logic at > all), and (b) it changes the vma permissions so turning something > read-only actually disables COW anyway, since it won't be a COW, it > will be a SIGSEGV. > > So mprotect() is irrelevant, other than the fact that it shares some > code with that "turn it read-only in the page tables". > > fork() is a much closer operation, in that it actually triggers that > COW behavior, but fork() takes the mmap_sem for writing, so it avoids > this too. > > So it's really just userfaultfd and that kind of ilk that is relevant > here, I think. But that "you need to flush the TLB before releasing > the page table lock" was not true (well, it's true in other > circumstances - just not *here*), and is not part of the solution. > > Or rather, if it's part of the solution here, it would have to be > matched with that "page copy needs to be done under the page table > lock too". > > Linus >