From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22453C77B61 for ; Fri, 28 Apr 2023 15:27:52 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B2F096B0072; Fri, 28 Apr 2023 11:27:51 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id AB80A6B007B; Fri, 28 Apr 2023 11:27:51 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9327F6B007D; Fri, 28 Apr 2023 11:27:51 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 7CA406B0072 for ; Fri, 28 Apr 2023 11:27:51 -0400 (EDT) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 46EFDACFE5 for ; Fri, 28 Apr 2023 15:27:51 +0000 (UTC) X-FDA: 80731179942.21.B024358 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (mail-co1nam11on2048.outbound.protection.outlook.com [40.107.220.48]) by imf18.hostedemail.com (Postfix) with ESMTP id 4F7751C0006 for ; Fri, 28 Apr 2023 15:27:48 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=Nvidia.com header.s=selector2 header.b=cVWVPCqR; arc=pass ("microsoft.com:s=arcselector9901:i=1"); spf=pass (imf18.hostedemail.com: domain of jgg@nvidia.com designates 40.107.220.48 as permitted sender) smtp.mailfrom=jgg@nvidia.com; dmarc=pass (policy=reject) header.from=nvidia.com ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1682695668; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=YvFMNhfDCXMZxLZyxFgb+3vq4JyL6U5sTKrYkkeSh7A=; b=F4bIqe/1Qu8OOq7hUiA7ldTR6/5B9skdg+ZKe4LhomeNCROentMUwvV6BMbxQy92fzn8CW 8WBQ+CUezUKJXcZR9nwTYGCfkENvk1nypxztYtalYjbD9w2XRykzBxqwjY9BRW4rCCqwVI 9BIzWgmD9BNci2nGa08sg1nNqnfUIjI= ARC-Authentication-Results: i=2; imf18.hostedemail.com; dkim=pass header.d=Nvidia.com header.s=selector2 header.b=cVWVPCqR; arc=pass ("microsoft.com:s=arcselector9901:i=1"); spf=pass (imf18.hostedemail.com: domain of jgg@nvidia.com designates 40.107.220.48 as permitted sender) smtp.mailfrom=jgg@nvidia.com; dmarc=pass (policy=reject) header.from=nvidia.com ARC-Seal: i=2; s=arc-20220608; d=hostedemail.com; t=1682695668; a=rsa-sha256; cv=pass; b=6q+ejQLF+acOa1aSd9r6dnqRLneRV6+D1Hgna8QBNv03Tst5RgVHxN40JnYNS7wEI/ThWl wbQsWoaiOfDQqOt67ZRPNixuPwfnH8eCNcUYerc78QQVb7uX/BNyUropArNSConelpXkW9 vlG2XlfR7+fFOHGqS7S1l5stOCxzRX4= ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kN6Ar/ZDYftIZFL+jXcOjZ9kU0FvXdr2Vz7PG4Jok9IhiR6KA/9esiEbgk7x8IqGOsUjaw/aMCYFo+8CjQfeAw8eKyrDC7eV7gsa0b/qtukkpe1cwIiha6cb0E9PoJcjz1j5BiYrYhYS74N2sf+v8CsC9aTIqaHnSAJLiE2ViVUdOEnmxp33pFroPFgGNNunmSWbH4XeQ2PaqoPil6ScS7NjOhzcVKF0T42YDKitpcujYRJUgvXzyntNfrZYtFb9i4ZQIeI/dA0RciT6WEyZZyG4SMkH0/FEHvNRUjvWRLZg7eF4bek0xc3ep8g9b+6JPRtGo2A0gAngkLlWC+mzmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=YvFMNhfDCXMZxLZyxFgb+3vq4JyL6U5sTKrYkkeSh7A=; b=EIR6esVLaAaj+yXOgfJYIKuXTNIYC46OzuYnZ5wCRgYyy18pV8Pe+finoXM/MM7H1cSzMvBWR05QDxtatAdHMcqtGr7cpePcX3PjMuPfo3RKAdDEwwQUzTBgnU1s7IsOBoWLS79VVItRlBmiifVDJjUREP9zsO6iFxQ8NH6APTQMaTgc2uCUdlGI2d9LDt5cpjDL9HI4mUDo3s2rV2qMQGKTQYRrIanAOzE87hcOfVhhZaTBnuKJP48g5FcTo7vBNIMdFjyDbQEIxcNb5AuK6V7PPu3hM8RpUfG7R3gl1KEo0T7IIBfMm31FJNYxsGFzAEVgSLq5G8U8Q9Jhztn2yw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YvFMNhfDCXMZxLZyxFgb+3vq4JyL6U5sTKrYkkeSh7A=; b=cVWVPCqRRrW3Y7TmqWGWgs+l7uOw3htZeS0O8edPlI4SbmVZwEgF0aSM2YMTe9QW0yuG5qwGUBsJgYgSYhkzY97CMyTzDeEkzji/3n0DW71rzSu+nMVzSpkbzSmF3m+neiRByVEy9fqz5kbJPq2b4lld15fvz6Vp1WE6Vy7o7CGCb5XteFPme2FS4nFeQNqGIH7lvOw7BRot566XPTcBI1ndipr7kLcn3XvkaIMEgEv0vKDjl9GE2cx7jBImMBIGzdIKZFCJZb7zW8j1I4kA9qElp37vn91Ezi6bSNpBpXN593EbkjltwbFgE+QMagObp4lwEXD6VkHvTzAt2vXL0w== Received: from LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) by IA0PR12MB7722.namprd12.prod.outlook.com (2603:10b6:208:432::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6340.21; Fri, 28 Apr 2023 15:27:45 +0000 Received: from LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::f7a7:a561:87e9:5fab]) by LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::f7a7:a561:87e9:5fab%6]) with mapi id 15.20.6340.024; Fri, 28 Apr 2023 15:27:45 +0000 Date: Fri, 28 Apr 2023 12:27:43 -0300 From: Jason Gunthorpe To: David Hildenbrand Cc: Lorenzo Stoakes , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton , Jens Axboe , Matthew Wilcox , Dennis Dalessandro , Leon Romanovsky , Christian Benvenuti , Nelson Escobar , Bernard Metzler , Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Mark Rutland , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Ian Rogers , Adrian Hunter , Bjorn Topel , Magnus Karlsson , Maciej Fijalkowski , Jonathan Lemon , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Christian Brauner , Richard Cochran , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , linux-fsdevel@vger.kernel.org, linux-perf-users@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, Oleg Nesterov , John Hubbard , Jan Kara , "Kirill A . Shutemov" , Pavel Begunkov , Mika Penttila , David Howells , Christoph Hellwig Subject: Re: [PATCH v5] mm/gup: disallow GUP writing to file-backed mappings by default Message-ID: References: <6b73e692c2929dc4613af711bdf92e2ec1956a66.1682638385.git.lstoakes@gmail.com> <094d2074-5b69-5d61-07f7-9f962014fa68@redhat.com> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <094d2074-5b69-5d61-07f7-9f962014fa68@redhat.com> X-ClientProxiedBy: MN2PR13CA0033.namprd13.prod.outlook.com (2603:10b6:208:160::46) To LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: LV2PR12MB5869:EE_|IA0PR12MB7722:EE_ X-MS-Office365-Filtering-Correlation-Id: 86458e87-2f96-4461-8030-08db47fd1d4b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: OT/bVm429jZdc8ZpTOTBTz8d5P74u27TZ+0ckMukm4Y0Q80/tlGc8jneXV1ghkNSmIO0Ee20Ieu9TK9CQaZC4LzTxDTO5eXrLWqkHc6MhoJ0lTz/HOrO0C5tunCPyCvEySgGRML6JPiGYfWEn+Nax1Zz4VvFk6UWVeJaFVQzdWysADoboZqdkLntlJJttbgTbIOoOATzQiOeKFPFKhLP0i412YXCk6Xd6bbUKg9mtSxnFgjWiSyAPqjL0Nfm+h6xwzZcaqa3tiyiMw1Jejjem0Gwo+TGzz16rElOBD1bvJxhgqz+4LmG7TT2JODPnXj1HZsmzyiOpviQml3yoSDaTxCzzH7mYFnSDNYnD4XHtkbpDZXdokJdaSiXX6c685apbS9EZuI3nJJFnSbQ4VgDMEWbgk4uttmiwsTI82sUQqG0AgWtK7XLMNKtSDXXKzCNTVwCas2AKSMEpM/g20ZIeC3JqTbcHenaBSurL11K8qozU3ECZZOcv8enPl680ifgNaOv5MekuWcGOntydDO/KAAsStaSZsTRsVHGr9H/hNDqnNfPLfGtLGg0VWPFPq9y X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LV2PR12MB5869.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(4636009)(346002)(366004)(376002)(39860400002)(396003)(136003)(451199021)(66556008)(38100700002)(5660300002)(66946007)(66476007)(8936002)(8676002)(41300700001)(316002)(86362001)(4326008)(7416002)(6916009)(7406005)(186003)(26005)(6506007)(6512007)(6486002)(36756003)(83380400001)(2616005)(2906002)(478600001)(54906003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?J2XwqdN26nv/ouioHeX87z7B9ARKEiU2ewg+gWNjIUUGFix8OGPu/fof8wE9?= =?us-ascii?Q?guhtBmg6e32NYLy6Am8kdUDZL4rzN5pA8wCr+Wb+Rt5qEhNud0cigQ1u5N4E?= =?us-ascii?Q?9nXfWFi9TOwD+DIEG6+7B1i4LEZ7Eb6BsaRPyjdEUrwpwrykzuCJJRyMTCug?= =?us-ascii?Q?j6pUu0exWhCT14eYtI9/vODJk5u6IYMZNW0sVw81tUe1ZwtFn5yOzHFFKkET?= =?us-ascii?Q?zo68JSC/spK5yMOdxC+uxsaMjRyPH3DztzN9ELgKCXJWyJuuvRZuYEHVNuSp?= =?us-ascii?Q?K/pRYZZAaSjDYsWD36L7I410l/dgVR1vwiP5hEt66dpAeDxuVkNFXDHGtz99?= =?us-ascii?Q?zxIxHdEUHBlVDdmdQ11jTNUmO+s0Vhb8CfcwTeCEMy94abhKQova+krCTIW9?= =?us-ascii?Q?aSfxruooguG+isXNZ0fKrtY38T36dzPCCj7V1Pt9wW0wrzgCqd3I3BIdN+e8?= =?us-ascii?Q?+TF8Isb4iyRw5cOZI1qgAtwk0lRRTyuy0jquiJnhoYvhbWG3/8RhR/ugOlbX?= =?us-ascii?Q?K6V+xdUV35WIuJj+yFyw8r8E242ELUd8D0c7eGHkfEgDAlBFHALoVjrNLH7G?= =?us-ascii?Q?Qg5wGLf9P9bNBU1U5xDHSe9O6JJPjI4ye76FPcq1VLAGCd+eWCm/nDaTN0+5?= =?us-ascii?Q?JpxFQ76pbDwe8AspdWsYnPGYaGCvgYsxQny/OEXhHhTsDbryNFmVymgCRcTU?= =?us-ascii?Q?yDBauVCh4chmbLjOizXDOS77KhRrSsLehFVEeCaS2uZEoBYuXCDDNlMYeJZb?= =?us-ascii?Q?LqHrRVTxclZXr78dBDZy5PEe0lm7cytHfRwrffuqJsE2YfgWcZubr84AEQNi?= =?us-ascii?Q?L61xi5Lm9VlfT7Sxk4IL4nAjWrAR+GfO2uVUGzip5EcUbGq2tXWdUsC5vUiF?= =?us-ascii?Q?W1AJ0vPvF0wM3cBPiQWcuYjJ1ojfXfupoY1d8XviLUwgoFd6fIRmez9cWUCy?= =?us-ascii?Q?i0eHPtJJCxuiMh2MddZqxYhOjKDq6y1+JusZBvG7gOk/u+ZJ8gdgqAxNUozW?= =?us-ascii?Q?n2GNlRqF2rbjMEHjyPT1KDS96qKEH7F4pAgvcAJ4ebaZFcS6cXJwFhX+pZqA?= =?us-ascii?Q?3ssYYy9v+jTfckI2C9sDPjoZjDTup03R4KRRHJxA7UUzIw7HGFszh6bLn0T/?= =?us-ascii?Q?R5ccWsF+9eXUskHxMg8XriFet9VyIKPr9cLS+jHbC2mQbeMtTMl6q8qsbc4V?= =?us-ascii?Q?F17UnzWs3jKWk1E1qsUSAcF7nXVV/0p4TiMmrjLEYnsjiTQ/y4uL6C7atoyB?= =?us-ascii?Q?b7+5JPx7dMsD5w1hMP6WuSV65GTkHpGqUILlopoiTyMKCBqL6nWT2auGxx6l?= =?us-ascii?Q?iTVcaDFaCmHdeDChSl2UHzjb6a6t9pgcbzjSKmvUuURu9O0xW3gmZRsxlWLv?= =?us-ascii?Q?LHFMnNaaLWbf8SkXoHaPq8PbbdOa3SnwoyESPYJWUoQOKlsnstyy9yTfAdUu?= =?us-ascii?Q?f3IU2sUCgAbgkLxq1mKQmVRS+/W/2UwyagisMdSkecBIpzNBSBY3jr5U88qC?= =?us-ascii?Q?e8eRjnY8sumewPAX/J4hmWsPS0mbahjnW4zF8sEzGMJZbJVRAq5YaINQXv6e?= =?us-ascii?Q?+gviITcIjmRuB5/+jIsI8lNGPz2J2OJ9DcL4RZNl?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 86458e87-2f96-4461-8030-08db47fd1d4b X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2023 15:27:45.0051 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: vR69WvcLgeWrQtDNIWAl5ebj/qQLAG+dh1PY3QhgExyQ5VjDO0h1Sec4UK9CNbYF X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR12MB7722 X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 4F7751C0006 X-Stat-Signature: 7ms49hnczyiccifo5u1qx1xdicfc39yk X-Rspam-User: X-HE-Tag: 1682695668-44225 X-HE-Meta: U2FsdGVkX19Ee4h4EtC7L6iCafQRlH/jZiBYnERXp/LS2BRjZsVld9uXwlNdRx9Sgg3v45w8V0k4GpBqPoFG6fzuj/v6fbQGakR4ViNv+A1Bk+alHLG6z5x2hF2XEolowkQoCQKDmp6rvIjfdASrncI1Q3bQre6ORo+fEE8qyGv4SlsgI72DOP4g1UBDqEpAITXbMXu12ddAXzX+fi4kugv1V5VKIA1XEtrtyhnytSFBXzA/aNnIKTkoZbPZjmVpcgSPWjkdp2fMWyySOF8l93+mjxy4cZTom+1tKneDJRq49K/BXZ92RMJq+Mx2EmWj+dJvqL7DI/h6Pyx6xipfNnYsBa6X0o/tvCWq0UxJtmcGOELI9+UquCqXvFPNj1EnaMdn8j5pwDhQE+C8Tqs2vjlylSypcrBeYC+bjYYC4QWVTWwffLrEIEX5l+61ZwvWCKdtiuyu0zyi4OYkTGQrUCsnWCPQZDs/SlWDOHNS6Xon8zp1LoUI+qDIV5Nw1XZ/WsMckSyjTBi4YcxaPNn9iGO9zpeGBO+sQMd6RES9tFGnwXFYIL1l33/VU1SA3wpIz27eYyIhZy+bbUSkhpoNrMPULuyCZqkVi6v6NNpGkKDqqi+53eEWJ8TojowbwokkxvcXOx6wc7LhrZou3u8+Q/yP2f1crTf3J4etm+/vzcf983eyFdYcQt78wkc5WNKvOJPyb49foLwcXDvQw9cTDaOlqQPubo91gCLGs7aPbFaP4EK8t4BZNKL3VPduwg9qYF2WHF4vco5py/HVDxVejHimcshVhMSPYJXARCCzveC6hHi6V2VZKlzqWo8ivDrqMFkHaV2jVRytXPPQjNnwvycM6/QH2cc2DxvAMlqloxSUTisyeHijkCmyn1lCJcw8htk9QKmmjgW4W4Fn0jMgNJRKjYpzsStvH/xfQNshEgFLw8I/9zVL37TjRHVfHp+gsZHk6lqvxxuV8GWS8WR BXgLVAlw jdBlNTEuZQ1nxcXUmR+n/EtwLmak4QpxGrizw3aNIOGJ04vlv6TPoTcDY4YXr4g3SMIqRzMz/rbAs9ozTXz/DcSG0Lqup2hsDb8yt7q2O8rDyYgwZWHf5zJx1qyxB1D/adP/9LItFMkcDbR8/5DzsGIpALQjrVNkzpaPPgUxtnB33cM5AC15Q6pCuoTztzHuetMGKxv79VJGyp0IZyoAgZDfl8wzJZD2lYIiK2lzOI5ynH632/zLCcy/746ZzDurK/Enn+c9Wu/BaFLSao4B0UX4plXgB3ZrD6Tz1 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Apr 28, 2023 at 05:08:27PM +0200, David Hildenbrand wrote: > > I think this is broken today and we should block it. We know from > > experiments with RDMA that doing exactly this triggers kernel oop's. > > I never saw similar reports in the wild (especially targeted at RHEL), so is > this still a current issue that has not been mitigated? Or is it just so > hard to actually trigger? People send RDMA related bug reports to us, and we tell them not to do this stuff :) > > I'm skeptical that anyone can actually do this combination of things > > successfully without getting kernel crashes or file data corruption - > > ie there is no real user to break. > > I am pretty sure that there are such VM users, because on the libvirt level > it's completely unclear which features trigger what behavior :/ IDK, why on earth would anyone want to do this? Using VFIO forces all the memory to become resident so what was the point of making it file backed in the first place? I'm skeptical there are real users even if it now requires special steps to be crashy/corrupty. > > > Sure, we could warn, or convert individual users using a flag (io_uring). > > > But maybe we should invest more energy on a fix? > > > > It has been years now, I think we need to admit a fix is still years > > away. Blocking the security problem may even motivate more people to > > work on a fix. > > Maybe we should make this a topic this year at LSF/MM (again?). At least we > learned a lot about GUP, what might work, what might not work, and got a > depper understanding (+ motivation to fix? :) ) the issue at hand. We keep having the topic.. This is the old argument that the FS people say the MM isn't following its inode and dirty lifetime rules and the MM people say the FS isn't following its refcounting rules > > Security is the primary case where we have historically closed uAPI > > items. > > As this patch > > 1) Does not tackle GUP-fast > 2) Does not take care of !FOLL_LONGTERM > > I am not convinced by the security argument in regard to this patch. It is incremental and a temperature check to see what kind of real users exist. We have no idea right now, just speculation. Like I said, if there is feedback we can weaken it even further. > Everything else sounds like band-aids to me, is insufficient, and might > cause more harm than actually help IMHO. Especially the gup-fast case is > extremely easy to work-around in malicious user space. It is true this patch should probably block gup_fast when using FOLL_LONGTERM as well, just like we used to do for the DAX check. Jason