From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.2 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7C31C433E0 for ; Wed, 23 Dec 2020 19:12:31 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 656E0221F5 for ; Wed, 23 Dec 2020 19:12:31 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 656E0221F5 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 8C00B8D004B; Wed, 23 Dec 2020 14:12:30 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 86FB38D0026; Wed, 23 Dec 2020 14:12:30 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 711208D004B; Wed, 23 Dec 2020 14:12:30 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0072.hostedemail.com [216.40.44.72]) by kanga.kvack.org (Postfix) with ESMTP id 5C2C58D0026 for ; Wed, 23 Dec 2020 14:12:30 -0500 (EST) Received: from smtpin03.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 24367181AEF23 for ; Wed, 23 Dec 2020 19:12:30 +0000 (UTC) X-FDA: 77625493260.03.list93_5202e402746b Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin03.hostedemail.com (Postfix) with ESMTP id 04D4D28A4E8 for ; Wed, 23 Dec 2020 19:12:29 +0000 (UTC) X-HE-Tag: list93_5202e402746b X-Filterd-Recvd-Size: 9518 Received: from mail-io1-f45.google.com (mail-io1-f45.google.com [209.85.166.45]) by imf45.hostedemail.com (Postfix) with ESMTP for ; Wed, 23 Dec 2020 19:12:29 +0000 (UTC) Received: by mail-io1-f45.google.com with SMTP id w18so192465iot.0 for ; Wed, 23 Dec 2020 11:12:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=qb0tc7BydwYkZNXccd9OZJoWvelQk+CP47NzXiB2qoM=; b=krLppYrJggRrdIffbbHEWXkW8VcHhFvGxZPH9PGQmhQtxckNSvhsxahbfh/LDcIuEi yAxOBPQVTuyhiFnU5zIRuPySMrwU6A889Qh9hAUs3F8YoqksmsA9+fTf0YIY26ppK8RL mJAj4KuTmWxGhTMxHzT0amyp+WYQahh7/M1t8MQY1cGVpCtCz2A2p0t9Im0ACNhZi8Do E78Js58M5RxDCaPlIt4yE//4aE33cDHdswhXj26VGoZg4KIv+j78rQ78/SfznD++KNeY jz7kzsa8CFWpelOuUaeXnDhjtcocQvQ3WOLdaJXxtfDiLjmf2fTduAB3ETpLZINGOtrf Da2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=qb0tc7BydwYkZNXccd9OZJoWvelQk+CP47NzXiB2qoM=; b=aAYIdTzwhdedNK/r7+XYbqqbEN+Bc7+R2WRBfWJBSF4Akxuu0fCE3H6PsjTY5k06tJ DudNcd1fmyKYURKG+xiO2kVQzV3vvgbNUTSvvRGHp00kV8A6opZPWs1MSdeVexV4Hw2e lam1B9929MQcDZPrOLoLJqqTGZ1IoqLL+0e2UrzcUTRgmTC71rmzzdCkTEfogHAwA6gx ua4mQ03/9bwKgrl2Dkrp5mnIwy/SpBuWGS9P0R2j1LSFO0TZaqPAfltH952ww+WXwISh kMtx+ZUIVDBt/hkDhmR+BMzg1GPYfIQ6+v2+w4fYZTnRqJ3nOLl7s+Abgmqj616jh7y+ CN5Q== X-Gm-Message-State: AOAM530KPTMEMhJTL9iOGJSfrXj4N0Cj86d+RO1gJeYG9bvJOgW+IZke ti5amawvX8DSnqTH1gdOT7rAUg== X-Google-Smtp-Source: ABdhPJz4a7OAQWBdn1CvL/P+G+4K+Opqz0lz3LESf8QB0QmYgHycQGi2Lz8Hm+xezfah7HwtTKha4g== X-Received: by 2002:a02:a498:: with SMTP id d24mr23961590jam.4.1608750748680; Wed, 23 Dec 2020 11:12:28 -0800 (PST) Received: from google.com ([2620:15c:183:200:7220:84ff:fe09:2d90]) by smtp.gmail.com with ESMTPSA id m8sm25523711ioh.16.2020.12.23.11.12.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Dec 2020 11:12:28 -0800 (PST) Date: Wed, 23 Dec 2020 12:12:23 -0700 From: Yu Zhao To: Peter Xu Cc: Linus Torvalds , Andrea Arcangeli , Andy Lutomirski , Nadav Amit , linux-mm , lkml , Pavel Emelyanov , Mike Kravetz , Mike Rapoport , stable , Minchan Kim , Will Deacon , Peter Zijlstra Subject: Re: [PATCH] mm/userfaultfd: fix memory corruption due to writeprotect Message-ID: References: <20201223162416.GD6404@xz-x1> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20201223162416.GD6404@xz-x1> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Dec 23, 2020 at 11:24:16AM -0500, Peter Xu wrote: > On Wed, Dec 23, 2020 at 03:06:30AM -0700, Yu Zhao wrote: > > On Wed, Dec 23, 2020 at 01:44:42AM -0800, Linus Torvalds wrote: > > > On Tue, Dec 22, 2020 at 4:01 PM Linus Torvalds > > > wrote: > > > > > > > > The more I look at the mprotect code, the less I like it. We seem to > > > > be much better about the TLB flushes in other places (looking at > > > > mremap, for example). The mprotect code seems to be very laissez-faire > > > > about the TLB flushing. > > > > > > No, this doesn't help. > > > > > > > Does adding a TLB flush to before that > > > > > > > > pte_unmap_unlock(pte - 1, ptl); > > > > > > > > fix things for you? > > > > > > It really doesn't fix it. Exactly because - as pointed out earlier - > > > the actual page *copy* happens outside the pte lock. > > > > I appreciate all the pointers. It seems to me it does. > > > > > So what can happen is: > > > > > > - CPU 1 holds the page table lock, while doing the write protect. It > > > has cleared the writable bit, but hasn't flushed the TLB's yet > > > > > > - CPU 2 did *not* have the TLB entry, sees the new read-only state, > > > takes a COW page fault, and reads the PTE from memory (into > > > vmf->orig_pte) > > > > In handle_pte_fault(), we lock page table and check pte_write(), so > > we either see a RW pte before CPU 1 runs or a RO one with no stale tlb > > entries after CPU 1 runs, assume CPU 1 flushes tlb while holding the > > same page table lock (not mmap_lock). > > I think this is not against Linus's example - where cpu2 does not have tlb > cached so it sees RO while cpu3 does have tlb cached so cpu3 can still modify > it. So IMHO there's no problem here. None of the CPUs has stale entries when CPU 2 sees a RO PTE. We are assuming that TLB flush will be done on CPU 1 while it's still holding page table lock. CPU 2 (re)locks page table and (re)checks the PTE under question when it decides if copy is necessary. If it sees a RO PTE, it means the flush has been done on all CPUs, therefore it fixes the problem. > But I do think in step 2 here we overlooked _PAGE_UFFD_WP bit. Note that if > it's uffd-wp wr-protection it's always applied along with removing of the write > bit in change_pte_range(): > > if (uffd_wp) { > ptent = pte_wrprotect(ptent); > ptent = pte_mkuffd_wp(ptent); > } > > So instead of being handled as COW page do_wp_page() will always trap > userfaultfd-wp first, hence no chance to race with COW. > > COW could only trigger after another uffd-wp-resolve ioctl which could remove > the _PAGE_UFFD_WP bit, but with Andrea's theory unprotect will only happen > after all wr-protect completes, which guarantees that when reaching the COW > path the tlb must has been flushed anyways. Then no one should be modifying > the page anymore even without pgtable lock in COW path. > > So IIUC what Linus proposed on "flushing tlb within pgtable lock" seems to > work, but it just may cause more tlb flush than Andrea's proposal especially > when the protection range is large (it's common to have a huge protection range > for e.g. VM live snapshotting, where we'll protect all guest rw ram). > > My understanding of current issue is that either we can take Andrea's proposal > (although I think the group rwsem may not be extremely better than a per-mm > rwsem, which I don't know... at least not worst than that?), or we can also go > the other way (also as Andrea mentioned) so that when wr-protect: > > - for <=2M range (pmd or less), we take read rwsem, but flush tlb within > pgtable lock > > - for >2M range, we take write rwsem directly but flush tlb once > > Thanks, > > > > > > - CPU 2 correctly decides it needs to be a COW, and copies the page contents > > > > > > - CPU 3 *does* have a stale TLB (because TLB invalidation hasn't > > > happened yet), and writes to that page in users apce > > > > > > - CPU 1 now does the TLB invalidate, and releases the page table lock > > > > > > - CPU 2 gets the page table lock, sees that its PTE matches > > > vmf->orig_pte, and switches it to be that writable copy of the page. > > > > > > where the copy happened before CPU 3 had stopped writing to the page. > > > > > > So the pte lock doesn't actually matter, unless we actually do the > > > page copy inside of it (on CPU2), in addition to doing the TLB flush > > > inside of it (on CPU1). > > > > > > mprotect() is actually safe for two independent reasons: (a) it does > > > the mmap_sem for writing (so mprotect can't race with the COW logic at > > > all), and (b) it changes the vma permissions so turning something > > > read-only actually disables COW anyway, since it won't be a COW, it > > > will be a SIGSEGV. > > > > > > So mprotect() is irrelevant, other than the fact that it shares some > > > code with that "turn it read-only in the page tables". > > > > > > fork() is a much closer operation, in that it actually triggers that > > > COW behavior, but fork() takes the mmap_sem for writing, so it avoids > > > this too. > > > > > > So it's really just userfaultfd and that kind of ilk that is relevant > > > here, I think. But that "you need to flush the TLB before releasing > > > the page table lock" was not true (well, it's true in other > > > circumstances - just not *here*), and is not part of the solution. > > > > > > Or rather, if it's part of the solution here, it would have to be > > > matched with that "page copy needs to be done under the page table > > > lock too". > > > > > > Linus > > > > > > > -- > Peter Xu >