From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.6 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A6BEC00A89 for ; Fri, 30 Oct 2020 21:20:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9118F22202 for ; Fri, 30 Oct 2020 21:20:47 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=nvidia.com header.i=@nvidia.com header.b="OGJK6ChB" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9118F22202 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=nvidia.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A52BC6B0036; Fri, 30 Oct 2020 17:20:46 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A048C6B005C; Fri, 30 Oct 2020 17:20:46 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 91B8C6B005D; Fri, 30 Oct 2020 17:20:46 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0024.hostedemail.com [216.40.44.24]) by kanga.kvack.org (Postfix) with ESMTP id 6614E6B0036 for ; Fri, 30 Oct 2020 17:20:46 -0400 (EDT) Received: from smtpin01.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 07FAA181AEF1D for ; Fri, 30 Oct 2020 21:20:46 +0000 (UTC) X-FDA: 77429861292.01.bikes97_331203227299 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin01.hostedemail.com (Postfix) with ESMTP id DAD7A1004D45F for ; Fri, 30 Oct 2020 21:20:45 +0000 (UTC) X-HE-Tag: bikes97_331203227299 X-Filterd-Recvd-Size: 10788 Received: from hqnvemgate25.nvidia.com (hqnvemgate25.nvidia.com [216.228.121.64]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Fri, 30 Oct 2020 21:20:44 +0000 (UTC) Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate25.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Fri, 30 Oct 2020 14:20:45 -0700 Received: from [10.2.58.85] (10.124.1.5) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 30 Oct 2020 21:20:42 +0000 Subject: Re: [PATCH v2 2/2] mm: prevent gup_fast from racing with COW during fork To: Jason Gunthorpe , , Peter Xu , Linus Torvalds CC: Andrea Arcangeli , Andrew Morton , Aneesh Kumar K.V , Christoph Hellwig , Hugh Dickins , Jan Kara , Jann Horn , Kirill Shutemov , Kirill Tkhai , Leon Romanovsky , Linux-MM , Michal Hocko , Oleg Nesterov References: <2-v2-dfe9ecdb6c74+2066-gup_fork_jgg@nvidia.com> From: John Hubbard Message-ID: Date: Fri, 30 Oct 2020 14:20:42 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.12.0 MIME-Version: 1.0 In-Reply-To: <2-v2-dfe9ecdb6c74+2066-gup_fork_jgg@nvidia.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [10.124.1.5] X-ClientProxiedBy: HQMAIL111.nvidia.com (172.20.187.18) To HQMAIL107.nvidia.com (172.20.187.13) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1604092845; bh=//keNAtR9KwX6RS4+pSPp0TaDXjSeHUDaPEhllV7rqI=; h=Subject:To:CC:References:From:Message-ID:Date:User-Agent: MIME-Version:In-Reply-To:Content-Type:Content-Language: Content-Transfer-Encoding:X-Originating-IP:X-ClientProxiedBy; b=OGJK6ChBcGRunBUnvVDN0vGP4VjMEy+6EhRPY+sOKLqy8DIHSg/z0ibuKWQUqXeZ3 0Tj1f8fwHL5SLmQSHNuBiKtn/K/pM016nhYlS2XBHmWHae53Pc+cyDK1DKftir+Ij8 rQkYe1GpK9xBZav2EFzHBzCSO//nBiClkQ0eC7JHWsa//0LUgoOFgesoUhLGhwUm33 KTeWge2m24cAVu0b9fkSTXYjk98AoigQeri3H9SgMdVyFxdLnM41/vlvUCVHLc5eSk 4HRUhBu536b0pBEGAfyQrrK0Cyw55YMSCSM83WeelsAJQ9NQei7q5nL+K+gJTUyjVE Tw3b8oTC2137w== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 10/30/20 7:46 AM, Jason Gunthorpe wrote: > Since commit 70e806e4e645 ("mm: Do early cow for pinned pages during > fork() for ptes") pages under a FOLL_PIN will not be write protected > during COW for fork. This means that pages returned from > pin_user_pages(FOLL_WRITE) should not become write protected while the pin > is active. > > However, there is a small race where get_user_pages_fast(FOLL_PIN) can > establish a FOLL_PIN at the same time copy_present_page() is write > protecting it: > > CPU 0 CPU 1 > get_user_pages_fast() > internal_get_user_pages_fast() > copy_page_range() > pte_alloc_map_lock() > copy_present_page() > atomic_read(has_pinned) == 0 > page_maybe_dma_pinned() == false > atomic_set(has_pinned, 1); > gup_pgd_range() > gup_pte_range() > pte_t pte = gup_get_pte(ptep) > pte_access_permitted(pte) > try_grab_compound_head() > pte = pte_wrprotect(pte) > set_pte_at(); > pte_unmap_unlock() > // GUP now returns with a write protected page > > The first attempt to resolve this by using the write protect caused > problems (and was missing a barrrier), see commit f3c64eda3e50 ("mm: avoid > early COW write protect games during fork()") > > Instead wrap copy_p4d_range() with the write side of a seqcount and check > the read side around gup_pgd_range(). If there is a collision then > get_user_pages_fast() fails and falls back to slow GUP. > > Slow GUP is safe against this race because copy_page_range() is only > called while holding the exclusive side of the mmap_lock on the src > mm_struct. > > Fixes: f3c64eda3e50 ("mm: avoid early COW write protect games during fork()") > Suggested-by: Linus Torvalds > Link: https://lore.kernel.org/r/CAHk-=wi=iCnYCARbPGjkVJu9eyYeZ13N64tZYLdOB8CP5Q_PLw@mail.gmail.com > Reviewed-by: John Hubbard This updated version still looks good to me. Love-love-love the new raw_seqcount approach! No more bare memory barriers, and it gains some kcsan coverage too. Sweet. :) thanks, -- John Hubbard NVIDIA > Signed-off-by: Jason Gunthorpe > --- > arch/x86/kernel/tboot.c | 1 + > drivers/firmware/efi/efi.c | 1 + > include/linux/mm_types.h | 7 +++++++ > kernel/fork.c | 1 + > mm/gup.c | 19 +++++++++++++++++++ > mm/init-mm.c | 1 + > mm/memory.c | 10 +++++++++- > 7 files changed, 39 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c > index 992fb1415c0f1f..6a2f542d9588a4 100644 > --- a/arch/x86/kernel/tboot.c > +++ b/arch/x86/kernel/tboot.c > @@ -93,6 +93,7 @@ static struct mm_struct tboot_mm = { > .pgd = swapper_pg_dir, > .mm_users = ATOMIC_INIT(2), > .mm_count = ATOMIC_INIT(1), > + .write_protect_seq = SEQCNT_ZERO(tboot_mm.write_protect_seq), > MMAP_LOCK_INITIALIZER(init_mm) > .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), > .mmlist = LIST_HEAD_INIT(init_mm.mmlist), > diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c > index 5e5480a0a32d7d..2520f6e05f4d44 100644 > --- a/drivers/firmware/efi/efi.c > +++ b/drivers/firmware/efi/efi.c > @@ -57,6 +57,7 @@ struct mm_struct efi_mm = { > .mm_rb = RB_ROOT, > .mm_users = ATOMIC_INIT(2), > .mm_count = ATOMIC_INIT(1), > + .write_protect_seq = SEQCNT_ZERO(efi_mm.write_protect_seq), > MMAP_LOCK_INITIALIZER(efi_mm) > .page_table_lock = __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock), > .mmlist = LIST_HEAD_INIT(efi_mm.mmlist), > diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h > index 5a9238f6caad97..f13beacda6fd23 100644 > --- a/include/linux/mm_types.h > +++ b/include/linux/mm_types.h > @@ -14,6 +14,7 @@ > #include > #include > #include > +#include > > #include > > @@ -446,6 +447,12 @@ struct mm_struct { > */ > atomic_t has_pinned; > > + /** > + * @write_protect_seq: Odd when any thread is write protecting > + * pages in this mm, for instance during fork(). > + */ > + seqcount_t write_protect_seq; > + > #ifdef CONFIG_MMU > atomic_long_t pgtables_bytes; /* PTE page table pages */ > #endif > diff --git a/kernel/fork.c b/kernel/fork.c > index 32083db7a2a23e..6fd934a6d60d96 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, > mm->vmacache_seqnum = 0; > atomic_set(&mm->mm_users, 1); > atomic_set(&mm->mm_count, 1); > + seqcount_init(&mm->write_protect_seq); > mmap_init_lock(mm); > INIT_LIST_HEAD(&mm->mmlist); > mm->core_state = NULL; > diff --git a/mm/gup.c b/mm/gup.c > index 150cc962c99201..7944749ed7252f 100644 > --- a/mm/gup.c > +++ b/mm/gup.c > @@ -2678,11 +2678,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start, > { > unsigned long flags; > int nr_pinned = 0; > + unsigned seq; > > if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) || > !gup_fast_permitted(start, end)) > return 0; > > + if (gup_flags & FOLL_PIN) { > + seq = raw_read_seqcount(¤t->mm->write_protect_seq); > + if (seq & 1) > + return 0; > + } > + > /* > * Disable interrupts. The nested form is used, in order to allow full, > * general purpose use of this routine. > @@ -2697,6 +2704,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start, > local_irq_save(flags); > gup_pgd_range(start, end, gup_flags, pages, &nr_pinned); > local_irq_restore(flags); > + > + /* > + * When pinning pages for DMA there could be a concurrent write protect > + * from fork() via copy_page_range(), in this case always fail fast GUP. > + */ > + if (gup_flags & FOLL_PIN) { > + if (read_seqcount_t_retry(¤t->mm->write_protect_seq, > + seq)) { > + unpin_user_pages(pages, nr_pinned); > + return 0; > + } > + } > return nr_pinned; > } > > diff --git a/mm/init-mm.c b/mm/init-mm.c > index 3a613c85f9ede2..153162669f8062 100644 > --- a/mm/init-mm.c > +++ b/mm/init-mm.c > @@ -31,6 +31,7 @@ struct mm_struct init_mm = { > .pgd = swapper_pg_dir, > .mm_users = ATOMIC_INIT(2), > .mm_count = ATOMIC_INIT(1), > + .write_protect_seq = SEQCNT_ZERO(init_mm.write_protect_seq), > MMAP_LOCK_INITIALIZER(init_mm) > .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), > .arg_lock = __SPIN_LOCK_UNLOCKED(init_mm.arg_lock), > diff --git a/mm/memory.c b/mm/memory.c > index c48f8df6e50268..294c2c3c4fe00d 100644 > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -1171,6 +1171,12 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) > mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE, > 0, src_vma, src_mm, addr, end); > mmu_notifier_invalidate_range_start(&range); > + /* > + * The read side doesn't spin, it goes to the mmap_lock, so the > + * raw version is used to avoid disabling preemption here > + */ > + mmap_assert_write_locked(src_mm); > + raw_write_seqcount_t_begin(&src_mm->write_protect_seq); > } > > ret = 0; > @@ -1187,8 +1193,10 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) > } > } while (dst_pgd++, src_pgd++, addr = next, addr != end); > > - if (is_cow) > + if (is_cow) { > + raw_write_seqcount_t_end(&src_mm->write_protect_seq); > mmu_notifier_invalidate_range_end(&range); > + } > return ret; > } > >