Re: [PATCH v2 2/2] mm: prevent gup_fast from racing with COW during fork

[John Hubbard <jhubbard@nvidia.com>]

On 10/30/20 7:46 AM, Jason Gunthorpe wrote:
> Since commit 70e806e4e645 ("mm: Do early cow for pinned pages during
> fork() for ptes") pages under a FOLL_PIN will not be write protected
> during COW for fork. This means that pages returned from
> pin_user_pages(FOLL_WRITE) should not become write protected while the pin
> is active.
> 
> However, there is a small race where get_user_pages_fast(FOLL_PIN) can
> establish a FOLL_PIN at the same time copy_present_page() is write
> protecting it:
> 
>          CPU 0                             CPU 1
>     get_user_pages_fast()
>      internal_get_user_pages_fast()
>                                         copy_page_range()
>                                           pte_alloc_map_lock()
>                                             copy_present_page()
>                                               atomic_read(has_pinned) == 0
> 					     page_maybe_dma_pinned() == false
>       atomic_set(has_pinned, 1);
>       gup_pgd_range()
>        gup_pte_range()
>         pte_t pte = gup_get_pte(ptep)
>         pte_access_permitted(pte)
>         try_grab_compound_head()
>                                               pte = pte_wrprotect(pte)
> 	                                     set_pte_at();
>                                           pte_unmap_unlock()
>        // GUP now returns with a write protected page
> 
> The first attempt to resolve this by using the write protect caused
> problems (and was missing a barrrier), see commit f3c64eda3e50 ("mm: avoid
> early COW write protect games during fork()")
> 
> Instead wrap copy_p4d_range() with the write side of a seqcount and check
> the read side around gup_pgd_range(). If there is a collision then
> get_user_pages_fast() fails and falls back to slow GUP.
> 
> Slow GUP is safe against this race because copy_page_range() is only
> called while holding the exclusive side of the mmap_lock on the src
> mm_struct.
> 
> Fixes: f3c64eda3e50 ("mm: avoid early COW write protect games during fork()")
> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
> Link: https://lore.kernel.org/r/CAHk-=wi=iCnYCARbPGjkVJu9eyYeZ13N64tZYLdOB8CP5Q_PLw@mail.gmail.com
> Reviewed-by: John Hubbard <jhubbard@nvidia.com>

This updated version still looks good to me. Love-love-love the new raw_seqcount
approach! No more bare memory barriers, and it gains some kcsan coverage too.
Sweet. :)

thanks,
-- 
John Hubbard
NVIDIA

> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>   arch/x86/kernel/tboot.c    |  1 +
>   drivers/firmware/efi/efi.c |  1 +
>   include/linux/mm_types.h   |  7 +++++++
>   kernel/fork.c              |  1 +
>   mm/gup.c                   | 19 +++++++++++++++++++
>   mm/init-mm.c               |  1 +
>   mm/memory.c                | 10 +++++++++-
>   7 files changed, 39 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
> index 992fb1415c0f1f..6a2f542d9588a4 100644
> --- a/arch/x86/kernel/tboot.c
> +++ b/arch/x86/kernel/tboot.c
> @@ -93,6 +93,7 @@ static struct mm_struct tboot_mm = {
>   	.pgd            = swapper_pg_dir,
>   	.mm_users       = ATOMIC_INIT(2),
>   	.mm_count       = ATOMIC_INIT(1),
> +	.write_protect_seq = SEQCNT_ZERO(tboot_mm.write_protect_seq),
>   	MMAP_LOCK_INITIALIZER(init_mm)
>   	.page_table_lock =  __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock),
>   	.mmlist         = LIST_HEAD_INIT(init_mm.mmlist),
> diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
> index 5e5480a0a32d7d..2520f6e05f4d44 100644
> --- a/drivers/firmware/efi/efi.c
> +++ b/drivers/firmware/efi/efi.c
> @@ -57,6 +57,7 @@ struct mm_struct efi_mm = {
>   	.mm_rb			= RB_ROOT,
>   	.mm_users		= ATOMIC_INIT(2),
>   	.mm_count		= ATOMIC_INIT(1),
> +	.write_protect_seq      = SEQCNT_ZERO(efi_mm.write_protect_seq),
>   	MMAP_LOCK_INITIALIZER(efi_mm)
>   	.page_table_lock	= __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
>   	.mmlist			= LIST_HEAD_INIT(efi_mm.mmlist),
> diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
> index 5a9238f6caad97..f13beacda6fd23 100644
> --- a/include/linux/mm_types.h
> +++ b/include/linux/mm_types.h
> @@ -14,6 +14,7 @@
>   #include <linux/uprobes.h>
>   #include <linux/page-flags-layout.h>
>   #include <linux/workqueue.h>
> +#include <linux/seqlock.h>
>   
>   #include <asm/mmu.h>
>   
> @@ -446,6 +447,12 @@ struct mm_struct {
>   		 */
>   		atomic_t has_pinned;
>   
> +		/**
> +		 * @write_protect_seq: Odd when any thread is write protecting
> +		 * pages in this mm, for instance during fork().
> +		 */
> +		seqcount_t write_protect_seq;
> +
>   #ifdef CONFIG_MMU
>   		atomic_long_t pgtables_bytes;	/* PTE page table pages */
>   #endif
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 32083db7a2a23e..6fd934a6d60d96 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
>   	mm->vmacache_seqnum = 0;
>   	atomic_set(&mm->mm_users, 1);
>   	atomic_set(&mm->mm_count, 1);
> +	seqcount_init(&mm->write_protect_seq);
>   	mmap_init_lock(mm);
>   	INIT_LIST_HEAD(&mm->mmlist);
>   	mm->core_state = NULL;
> diff --git a/mm/gup.c b/mm/gup.c
> index 150cc962c99201..7944749ed7252f 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -2678,11 +2678,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start,
>   {
>   	unsigned long flags;
>   	int nr_pinned = 0;
> +	unsigned seq;
>   
>   	if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) ||
>   	    !gup_fast_permitted(start, end))
>   		return 0;
>   
> +	if (gup_flags & FOLL_PIN) {
> +		seq = raw_read_seqcount(&current->mm->write_protect_seq);
> +		if (seq & 1)
> +			return 0;
> +	}
> +
>   	/*
>   	 * Disable interrupts. The nested form is used, in order to allow full,
>   	 * general purpose use of this routine.
> @@ -2697,6 +2704,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start,
>   	local_irq_save(flags);
>   	gup_pgd_range(start, end, gup_flags, pages, &nr_pinned);
>   	local_irq_restore(flags);
> +
> +	/*
> +	 * When pinning pages for DMA there could be a concurrent write protect
> +	 * from fork() via copy_page_range(), in this case always fail fast GUP.
> +	 */
> +	if (gup_flags & FOLL_PIN) {
> +		if (read_seqcount_t_retry(&current->mm->write_protect_seq,
> +					  seq)) {
> +			unpin_user_pages(pages, nr_pinned);
> +			return 0;
> +		}
> +	}
>   	return nr_pinned;
>   }
>   
> diff --git a/mm/init-mm.c b/mm/init-mm.c
> index 3a613c85f9ede2..153162669f8062 100644
> --- a/mm/init-mm.c
> +++ b/mm/init-mm.c
> @@ -31,6 +31,7 @@ struct mm_struct init_mm = {
>   	.pgd		= swapper_pg_dir,
>   	.mm_users	= ATOMIC_INIT(2),
>   	.mm_count	= ATOMIC_INIT(1),
> +	.write_protect_seq = SEQCNT_ZERO(init_mm.write_protect_seq),
>   	MMAP_LOCK_INITIALIZER(init_mm)
>   	.page_table_lock =  __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock),
>   	.arg_lock	=  __SPIN_LOCK_UNLOCKED(init_mm.arg_lock),
> diff --git a/mm/memory.c b/mm/memory.c
> index c48f8df6e50268..294c2c3c4fe00d 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1171,6 +1171,12 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
>   		mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE,
>   					0, src_vma, src_mm, addr, end);
>   		mmu_notifier_invalidate_range_start(&range);
> +		/*
> +		 * The read side doesn't spin, it goes to the mmap_lock, so the
> +		 * raw version is used to avoid disabling preemption here
> +		 */
> +		mmap_assert_write_locked(src_mm);
> +		raw_write_seqcount_t_begin(&src_mm->write_protect_seq);
>   	}
>   
>   	ret = 0;
> @@ -1187,8 +1193,10 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
>   		}
>   	} while (dst_pgd++, src_pgd++, addr = next, addr != end);
>   
> -	if (is_cow)
> +	if (is_cow) {
> +		raw_write_seqcount_t_end(&src_mm->write_protect_seq);
>   		mmu_notifier_invalidate_range_end(&range);
> +	}
>   	return ret;
>   }
>   
>