From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71969C77B7A for ; Wed, 17 May 2023 18:37:52 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C2DC1900006; Wed, 17 May 2023 14:37:51 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id BDE40900003; Wed, 17 May 2023 14:37:51 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AA6D8900006; Wed, 17 May 2023 14:37:51 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 97970900003 for ; Wed, 17 May 2023 14:37:51 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 71408120698 for ; Wed, 17 May 2023 18:37:51 +0000 (UTC) X-FDA: 80800605942.09.DDEB493 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf24.hostedemail.com (Postfix) with ESMTP id 4C9A1180015 for ; Wed, 17 May 2023 18:37:48 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b="hx+hFJD/"; spf=pass (imf24.hostedemail.com: domain of peterx@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=peterx@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684348668; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=JLPdxGUTBg20W3CGR0dZEIDMHjZdIhg7vk/F4BU7czc=; b=BEZs9/AXSVUGSbJwM0fdrytmY19FhyNGGbEjtrXr/mypK1+Pbmr3dP4YAi7TQGR1hbtwuj Ttl15dcdjEcB+EaXG19DrS/oqMmAFIULfEmsPTSDCGYCoy1f3JZjRoxvv8yNYmPIKo6S7E YAQQpiPJDuhxb0Fp79OpEMZFqyEzVnk= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b="hx+hFJD/"; spf=pass (imf24.hostedemail.com: domain of peterx@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=peterx@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684348668; a=rsa-sha256; cv=none; b=jHRMXXSBke/c5cwW89L+KnD6Afqu2vtu6p61vbW91N6Cn5v6+N4DEVcNERnyGkLSIrk+pg 4Gx6fKPmzZM8yFFFiH3NuSRReXmodQCb1VudH/mqeUNG9OkrcXSxc4pYZDH+nIRmo3Q/5J qeBdS2wqWFI+nOtcnfHBISHoG+sXZJk= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1684348667; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=JLPdxGUTBg20W3CGR0dZEIDMHjZdIhg7vk/F4BU7czc=; b=hx+hFJD/y+RzQLm/kI6j6eZw7XCE1yRQyCEVnpDDow1khBXgHHWw9FJJ8cZSjPKJr+T7wW FUGKjziILJEBoscu7pdiLSpYFdQhzxjL/CCzAkOMDaJj68vl77z9dQ39XpaPn1Pi3WVoXc 8OllRGglSm9hSOsuxGAuqE1cvjkKjT0= Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-329-ue6oHRpNO6uoPid-jr4Qkw-1; Wed, 17 May 2023 14:37:44 -0400 X-MC-Unique: ue6oHRpNO6uoPid-jr4Qkw-1 Received: by mail-qt1-f197.google.com with SMTP id d75a77b69052e-3f38280ec63so2185121cf.1 for ; Wed, 17 May 2023 11:37:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684348663; x=1686940663; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=JLPdxGUTBg20W3CGR0dZEIDMHjZdIhg7vk/F4BU7czc=; b=Xw9h3O2hIDSNEU6BXckrDomsBiijpH/0eYpw2dLi/Nl9qLu+Rb56OL9R9cqeKViv0C EK90lrCzrQQJwRPT1UqWHDQOoFZoDnsv2uZD7SMlkNvJiZXUc1ewKaRsrrE6eTSkJ+o7 brcEmHth8rynKrc0eyXHDLTJOJUqKvDpRwY/p9ejdCHqcjX+T++itAt/ntzZ50h2Qw+6 4UrkOdupMnzjniXDDDCos3GGMxTc2XSHY5jOhH+QC//36wH349COZcdySSi+DSae1Uq1 6ebA6HRboktWEL4nSW0+cnKr/kjxsNOERdcz4T07VbpJuoENDpdpwfUPprnpQMskOuW8 0/pg== X-Gm-Message-State: AC+VfDxsOck0hITe1AUIVLWQocp/4zhlfhvUKyW9PiDp3UjG3AshIzsL m5RqTTqtMvyz1gIHUDj7Ojh9ek6imVnS3qa2Hc4xZHOahdgAcQI7vNf7b5z206qdrv7mWnz+j4b BOyEsCJQxzHI= X-Received: by 2002:ac8:7f84:0:b0:3ef:59e8:511f with SMTP id z4-20020ac87f84000000b003ef59e8511fmr6977128qtj.0.1684348663614; Wed, 17 May 2023 11:37:43 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4ax7reh1jO1s+mjgPfu0bUCpza/vvE+YPfmf6+fzSZu2+Qnp8AR1sn7TrrVkE7eL+VAWoRPg== X-Received: by 2002:ac8:7f84:0:b0:3ef:59e8:511f with SMTP id z4-20020ac87f84000000b003ef59e8511fmr6977107qtj.0.1684348663308; Wed, 17 May 2023 11:37:43 -0700 (PDT) Received: from x1n (bras-base-aurron9127w-grc-62-70-24-86-62.dsl.bell.ca. [70.24.86.62]) by smtp.gmail.com with ESMTPSA id l30-20020ac8459e000000b003e97fe68511sm7346475qtn.3.2023.05.17.11.37.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 May 2023 11:37:42 -0700 (PDT) Date: Wed, 17 May 2023 14:37:41 -0400 From: Peter Xu To: Lorenzo Stoakes Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, Andrew Morton , "Liam R . Howlett" , Mark Rutland , Andrea Arcangeli , Mike Rapoport , Alexander Viro , linux-stable Subject: Re: [PATCH 1/2] mm/uffd: Fix vma operation where start addr cuts part of vma Message-ID: References: <20230517150408.3411044-1-peterx@redhat.com> <20230517150408.3411044-2-peterx@redhat.com> <4a68aee6-68d9-4d17-bb7f-cda3910f6f1f@lucifer.local> MIME-Version: 1.0 In-Reply-To: <4a68aee6-68d9-4d17-bb7f-cda3910f6f1f@lucifer.local> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Disposition: inline X-Stat-Signature: kasmeg4nubq1wmd8sd7ar9yo6qz5mz7f X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 4C9A1180015 X-Rspam-User: X-HE-Tag: 1684348668-619406 X-HE-Meta: U2FsdGVkX1/ono/3eaTXpYw4r7QM8/ixvO8EQEObuy2e+YRU52iDTRqo//Hj+d5qA+DaUCCospHtKSAMT5RbNunYztnZn1kN0gcY8yiAWnRMB6f5eela0LYpPRQp1AQ/O0Y2LRVNARJpJqCJ747e/dKxjjR+qCEtDOYmm7gRQxRC6gvI/qNmyHSvCwHuaj/JWZsXcGFkqBaO6YVh0e98Ey0e1vkI1vYsIuX9h7Vj/kdM4U4FySsKN8iFRigm4rQ1fRTQGX84xZOyH9YJVG9anPuahbeOXxpZzu9hgZXAxF+00H7Hd330rER2pdzVdLyUfh1kgs1pwUG66sf8qbB0mZk8F8CpoGmGT8n+vs7QnLw+ZGklCw3tCxHQCSao6LAbDsfF4Fa3uIVQFiRVL87Tc/ylzKwdFAv7KNW/oGHZsa2BnIGzXCKRdcF2Pdp67n5L7QNf0jk5BKpJtEcf8/3FDJHcrvFd6QI0ZXCeHTOdzAThw4W4hUshSB+aa5VUkwPoU0RXh9oc6u6idejjnq3rv5yiTeEjN/ef2nZfA9YLMIL9ErzYgLjzleiit2VgaI7zuiQA1bzOMnzB1dEKo/mauBYWYpaiR60ijNO8IGnalJ1+QrPByCXadX0pRUdwtKYA6nbvKxnibpiTI0N3OmIp9gCieXHHcpvLG3iepgIq2r5GROSPwzK8rh6oKkZBH05wkfKksHaTkRVEFgSFNVW1q4wvOrC1SpyzGArp5iNyF40sHsG1zKFNoKJvcKn0hHcB9UMsudsO6S7TDY8zzvH5hHwgqIt6SX4T9datiIx0eiprhkYJnt0zWXhXF0xZWVPeWUv8ybq5omi1+pOS+O6j9aUvZ6+t9jP/TOg+3liigjCbt0xYt1bYA0aoOaiqXcEB/Wlt1RxLRkZb2x+cxpIw0YDW7U8CHTdYJZX3sjv3+amkY6kWOgw8zvM7tmUxJU5VfvZlGO0LjlLcZZptNG5 xb6GVPQL M+XPDx92Unmn8b6+ruEXscfP5pygRbHMfoZMtKZoNTtBTyxdjb7cEgrmp8E9ZDqcjesZ7iP1cI9tKYjJ3mL2kSLec5NGhf+tjT8r71A5aBmp0Hzeg639wU7PE9ppQGaqGZF4FK72f15+tIC+AP8ZvhP14ntJ1RV6Q6VgNH8r+yDkfWl8vVl5IrpkP5wNT/rPNAzISJ/Un3EOESPz2zZQvmpPs2bt+IJ1Bz4R/Gka41mMFFO4Wzmz39w2vDuToQLOI9KRE0crkjbQJy+mljQFsWxYNcgJWQcJdd9zEjQa5HwQ8Z8c86Vlo5eXa8DiGWbChY3kbIAJTBdjNb2vZvLXHqUxfU1bsMGV0gbH0n1rovGoucsgb8C4J8YH69hgxjNrLsHp796HzI8EhrAQ3UjL3yMmzXwyAPn+Vta20/SO0C9ncZkv53jUO9D0bJSTsEPVmto8l2ho4vRR7DnSijOw1lg3nUvCi0ePlJgg8eQkRvOPZtWH9Xnf7tETf2FWFqIc/fnFccpp+HUGQbdfEw+hEUfafMM4IszuuM1qk+qoR6JvaUII= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, May 17, 2023 at 06:20:55PM +0100, Lorenzo Stoakes wrote: > On Wed, May 17, 2023 at 11:04:07AM -0400, Peter Xu wrote: > > It seems vma merging with uffd paths is broken with either > > register/unregister, where right now we can feed wrong parameters to > > vma_merge() and it's found by recent patch which moved asserts upwards in > > vma_merge() by Lorenzo Stoakes: > > > > https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ > > > > The problem is in the current code base we didn't fixup "prev" for the case > > where "start" address can be within the "prev" vma section. In that case > > we should have "prev" points to the current vma rather than the previous > > one when feeding to vma_merge(). > > This doesn't seem quite correct, perhaps - "where start is contained within vma > but not clamped to its start. We need to convert this into case 4 which permits > subdivision of prev by assigning vma to prev. As we loop, each subsequent VMA > will be clamped to the start." I think it covers more than case 4 - it can also be case 0 where no merge will happen? > > > > > This patch will eliminate the report and make sure vma_merge() calls will > > become legal again. > > > > One thing to mention is that the "Fixes: 29417d292bd0" below is there only > > to help explain where the warning can start to trigger, the real commit to > > fix should be 69dbe6daf104. Commit 29417d292bd0 helps us to identify the > > issue, but unfortunately we may want to keep it in Fixes too just to ease > > kernel backporters for easier tracking. > > > > Cc: Lorenzo Stoakes > > Cc: Mike Rapoport (IBM) > > Cc: Liam R. Howlett > > Reported-by: Mark Rutland > > Fixes: 29417d292bd0 ("mm/mmap/vma_merge: always check invariants") > > Fixes: 69dbe6daf104 ("userfaultfd: use maple tree iterator to iterate VMAs") > > Closes: https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ > > Cc: linux-stable > > Signed-off-by: Peter Xu > > --- > > fs/userfaultfd.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c > > index 0fd96d6e39ce..17c8c345dac4 100644 > > --- a/fs/userfaultfd.c > > +++ b/fs/userfaultfd.c > > @@ -1459,6 +1459,8 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, > > > > vma_iter_set(&vmi, start); > > prev = vma_prev(&vmi); > > + if (vma->vm_start < start) > > + prev = vma; > > > > ret = 0; > > for_each_vma_range(vmi, vma, end) { > > @@ -1625,6 +1627,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, > > > > vma_iter_set(&vmi, start); > > prev = vma_prev(&vmi); > > + if (vma->vm_start < start) > > + prev = vma; > > + > > ret = 0; > > for_each_vma_range(vmi, vma, end) { > > cond_resched(); > > -- > > 2.39.1 > > > > Other than that looks good:- > > Reviewed-by: Lorenzo Stoakes Thanks to both on the quick reviews! -- Peter Xu