From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.5 required=3.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FSL_HELO_FAKE,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88937C4361B for ; Sun, 20 Dec 2020 09:54:52 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0DF24233F6 for ; Sun, 20 Dec 2020 09:54:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0DF24233F6 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EC9DE6B005C; Sun, 20 Dec 2020 04:54:50 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E7BA56B005D; Sun, 20 Dec 2020 04:54:50 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D90D66B0068; Sun, 20 Dec 2020 04:54:50 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0050.hostedemail.com [216.40.44.50]) by kanga.kvack.org (Postfix) with ESMTP id C0A9B6B005C for ; Sun, 20 Dec 2020 04:54:50 -0500 (EST) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 7F273180AD837 for ; Sun, 20 Dec 2020 09:54:50 +0000 (UTC) X-FDA: 77613201540.16.peace93_2f0227c2744d Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin16.hostedemail.com (Postfix) with ESMTP id 56A3A100E6903 for ; Sun, 20 Dec 2020 09:54:50 +0000 (UTC) X-HE-Tag: peace93_2f0227c2744d X-Filterd-Recvd-Size: 8472 Received: from mail-il1-f169.google.com (mail-il1-f169.google.com [209.85.166.169]) by imf01.hostedemail.com (Postfix) with ESMTP for ; Sun, 20 Dec 2020 09:54:49 +0000 (UTC) Received: by mail-il1-f169.google.com with SMTP id q5so6243130ilc.10 for ; Sun, 20 Dec 2020 01:54:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=g1f+hTqJ01sTRRK/QRqCfkwd/KCqqcEThWLus7s2oL8=; b=KO0s5hkNfoe/HC+Lo6UxShdkpn5i8FtDgEZQeFoyZOnSVPubj7oYpPjvH0tqybGefX 3ecsUHL0N6yBTXk+jSaYiDXIcqr0hpOF21yjZ77YkbVYaO4lcqfZcS1l/E/YHAiw7WJp CYgDTmQs3gbTipvWuc+UOZsXMCv6g3xJJJOMaqZvHoKW3qpDH2Awrg/6t/jybqU7M4m+ 86g+qtJLaID/LToDTFQT84HVzxwXys5m7LykpSMAQe/8D3wvNBsE4TFFNF32ADkBYMfK OiaIbVfChL+FJJ2yDOjBGwUNPjv4tHPJ8LZHeOewEkrmgi4lsPOauaFRfJNqvWCtUmWC XZjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=g1f+hTqJ01sTRRK/QRqCfkwd/KCqqcEThWLus7s2oL8=; b=GNq6MDgEQN35she1OjGHwQPpbFOeTP8S7a+gCV3RKCAAQ7/gU80zaUwMhXFguBpst+ 04jMhdJne8JwTeVmPrkUDQM2g1EjRiW83cV3WFbjo8MxOp4npf7yGzbTUFtVKk00hteS uz9yJRAHiKy1RgWwOp7+fYJAfEAZr8SrIgOLgdbcDLRkY4MNakXlqgCsXaM8kovJHh4T VV0ha0O/Vj4vMcWbiS97jy5xBSxYFlVKOo/kbFxQJIHYEXQD7TbwFiK8+PURNpVQP71q wDQlqWSuah9c/CePCnMg2GnHJi517ZHS8c29nq+dWK/xDTkG1fBdkavYHJ/5qvGINHNo Uxmw== X-Gm-Message-State: AOAM533+8K4abYEx6AbJ2hS4DQXwMy9LmWrwW6KWFuqRBAPK6qz4eS8S z6bNxzsjB9fi1A3yhSuLCOHfYg== X-Google-Smtp-Source: ABdhPJwFXRHS7o4frczZ+ABNBpZU+cZA2RhD15NOmpz8TH5RvcGdGctXc98YQroLdgxv8GyB8XuMjg== X-Received: by 2002:a92:d0d:: with SMTP id 13mr1203977iln.209.1608458089138; Sun, 20 Dec 2020 01:54:49 -0800 (PST) Received: from google.com ([2620:15c:183:200:7220:84ff:fe09:2d90]) by smtp.gmail.com with ESMTPSA id d1sm20445472ioh.3.2020.12.20.01.54.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 20 Dec 2020 01:54:48 -0800 (PST) Date: Sun, 20 Dec 2020 02:54:44 -0700 From: Yu Zhao To: Nadav Amit Cc: Andrea Arcangeli , linux-mm , Peter Xu , lkml , Pavel Emelyanov , Mike Kravetz , Mike Rapoport , stable@vger.kernel.org, minchan@kernel.org, Andy Lutomirski , Will Deacon , Peter Zijlstra Subject: Re: [PATCH] mm/userfaultfd: fix memory corruption due to writeprotect Message-ID: References: <20201219043006.2206347-1-namit@vmware.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, Dec 20, 2020 at 12:06:38AM -0800, Nadav Amit wrote: > > On Dec 19, 2020, at 10:05 PM, Yu Zhao wrote: > >=20 > > On Sat, Dec 19, 2020 at 01:34:29PM -0800, Nadav Amit wrote: > >> [ cc=E2=80=99ing some more people who have experience with similar p= roblems ] > >>=20 > >>> On Dec 19, 2020, at 11:15 AM, Andrea Arcangeli wrote: > >>>=20 > >>> Hello, > >>>=20 > >>> On Fri, Dec 18, 2020 at 08:30:06PM -0800, Nadav Amit wrote: > >>>> Analyzing this problem indicates that there is a real bug since > >>>> mmap_lock is only taken for read in mwriteprotect_range(). This mi= ght > >>>=20 > >>> Never having to take the mmap_sem for writing, and in turn never > >>> blocking, in order to modify the pagetables is quite an important > >>> feature in uffd that justifies uffd instead of mprotect. It's not t= he > >>> most important reason to use uffd, but it'd be nice if that guarant= ee > >>> would remain also for the UFFDIO_WRITEPROTECT API, not only for the > >>> other pgtable manipulations. > >>>=20 > >>>> Consider the following scenario with 3 CPUs (cpu2 is not shown): > >>>>=20 > >>>> cpu0 cpu1 > >>>> ---- ---- > >>>> userfaultfd_writeprotect() > >>>> [ write-protecting ] > >>>> mwriteprotect_range() > >>>> mmap_read_lock() > >>>> change_protection() > >>>> change_protection_range() > >>>> ... > >>>> change_pte_range() > >>>> [ defer TLB flushes] > >>>> userfaultfd_writeprotect() > >>>> mmap_read_lock() > >>>> change_protection() > >>>> [ write-unprotect ] > >>>> ... > >>>> [ unprotect PTE logically ] > >>>> ... > >>>> [ page-fault] > >>>> ... > >>>> wp_page_copy() > >>>> [ set new writable page in PTE] > >=20 > > I don't see any problem in this example -- wp_page_copy() calls > > ptep_clear_flush_notify(), which should take care of the stale entry > > left by cpu0. > >=20 > > That being said, I suspect the memory corruption you observed is > > related this example, with cpu1 running something else that flushes > > conditionally depending on pte_write(). > >=20 > > Do you know which type of pages were corrupted? file, anon, etc. >=20 > First, Yu, you are correct. My analysis is incorrect, but let me have > another try (below). To answer your (and Andrea=E2=80=99s) question - t= his happens > with upstream without any changes, excluding a small fix to the selftes= t, > since it failed (got stuck) due to missing wake events. [1] >=20 > We are talking about anon memory. >=20 > So to correct myself, I think that what I really encountered was actual= ly > during MM_CP_UFFD_WP_RESOLVE (i.e., when the protection is removed). Th= e > problem was that in this case the =E2=80=9Cwrite=E2=80=9D-bit was remov= ed during unprotect. Thanks. You are right about when the problem happens: UFD write- UNprotecting. But it's not UFD write-UNprotecting that removes the writable bit -- the bit can only be removed during COW or UFD write-protecting. So your original example was almost correct, except the last line describing cpu1. The problem is how do_wp_page() handles non-COW pages. (For COW pages, do_wp_page() works correctly by either reusing an existing page or make a new copy out of it.) In UFD case, the existing page may not have been properly write-protected. As you pointed out, the tlb flush may not be done yet. Making a copy can potentially race with the writer on cpu2. Should we fix the problem by ensuring integrity of the copy? IMO, no, because do_wp_page() shouldn't copy at all in this case. It seems it was recently broken by be068f29034f mm: fix misplaced unlock_page in do_wp_page() 09854ba94c6a mm: do_wp_page() simplification I haven't study them carefully. But if you could just revert them and run the test again, we'd know where exactly to look at next. > Sorry for the strange formatting to fit within 80 columns: >=20 >=20 > [ Start: PTE is writable ] >=20 > cpu0 cpu1 cpu2 > ---- ---- ---- > [ Writable PTE=20 > cached in TLB ] > userfaultfd_writeprotect() =09 > [ write-*unprotect* ] > mwriteprotect_range() > mmap_read_lock() > change_protection() >=20 > change_protection_range() > ... > change_pte_range() > [ *clear* =E2=80=9Cwrite=E2=80=9D-bit ] > [ defer TLB flushes] > [ page-fault ] > =E2=80=A6 > wp_page_copy() > cow_user_page() > [ copy page ] > [ write to old > page ] > =E2=80=A6 > set_pte_at_notify() >=20 > [ End: cpu2 write not copied form old to new page. ] >=20 >=20 > So this was actually resolved by the second part of the patch - changin= g > preserve_write in change_pte_range(). I removed the acquisition of mmap= _lock > for write, left the change in change_pte_range() and the test passes. >=20 > Let me give some more thought on whether a mmap_lock is needed=20 > for write. I need to rehash this TLB flushing algorithm. >=20 > Thanks, > Nadav >=20 > [1] https://lore.kernel.org/patchwork/patch/1346386