From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D54EC38A2D for ; Tue, 25 Oct 2022 10:17:53 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C93018E0002; Tue, 25 Oct 2022 06:17:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C43308E0001; Tue, 25 Oct 2022 06:17:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B32028E0002; Tue, 25 Oct 2022 06:17:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id A527E8E0001 for ; Tue, 25 Oct 2022 06:17:52 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 672181A027E for ; Tue, 25 Oct 2022 10:17:52 +0000 (UTC) X-FDA: 80059070784.09.F9BB294 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by imf28.hostedemail.com (Postfix) with ESMTP id BFA01C001F for ; Tue, 25 Oct 2022 10:17:50 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9B8C9B81CD1; Tue, 25 Oct 2022 10:17:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8AC4FC433C1; Tue, 25 Oct 2022 10:17:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1666693067; bh=loBjWPuoKTGF/gO56VzkKo6krQdgRby7JIrG/EzZOSQ=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=d6ZDNCAcK4F26u54xQf8kDBp/8b3DW5BfO6g1lzeUvpUqST0Kw+Ohe0820AGWKYi+ /7Iqw8NZ0p6eQ/pqwMi1Gu67j2R14VHUyxddgBClTRfmn7+eiBCfjsq3GSF79nNNGz 0X7g+J7DfNAmhkRl2i3xi1iShD/jLXV9iOD0Aj/KAyEV5IbzhVMFLMbIuW+YD0HX3T B8i2fs2s6CKT9WlZ6lTFZXa/hnB4DlVRnIIZi1IMECfFVAoF+8Q0qD/kHO/VT7rrxh ahRkwDT3WUrOsLHpVfVQd0i2lzMAzWlJ4qQ4wL0BQod1CCuVzaQiHLp5VsXHdnMHQK 2bogCqmt8gCvw== Message-ID: Date: Tue, 25 Oct 2022 12:17:43 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.3.3 Subject: Re: [PATCH v2 0/8] Fix several device private page reference counting issues Content-Language: en-US To: Alistair Popple , Andrew Morton , linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org, nouveau@lists.freedesktop.org, dri-devel@lists.freedesktop.org, Felix Kuehling , Lyude Paul References: From: "Vlastimil Babka (SUSE)" In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1666693071; a=rsa-sha256; cv=none; b=nLn+gKunLfbxWSCAiyW1idxUPVSz1RB9SRLHxKSTOkeQJOZJJqoXXEgg10I1fVBBpj/5Rk QpLZAypMF/1MkAU7Yef7nonlijN/EbX/bH8NFz0HJgOwFDdJrX7akoOv06WYvJFoK5n55A oSZcJCwRTsE+QZq00Wor02eat0whLa0= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=d6ZDNCAc; spf=pass (imf28.hostedemail.com: domain of vbabka@kernel.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=vbabka@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1666693071; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uzo+m+yxkYwzyyHwadLFPJlbIQv7qpQLm70p+UN05hA=; b=rEVnTdpBLjB3hK1XSnzDjVZ8MsSVOZ/o7qI5ZucN53Nz2fQeZvcsYgBq0Xn3f1elnjN9JA omBWo/DVzKwo/qrWrn5LhZkmvJ4AGvQn/x5tMu4G3TgAk5/LbdnrT+i++ge45So4ivXHuv nuTu+usEXUehJUcB0qaz6dm0L0JJqHs= X-Rspam-User: X-Rspamd-Queue-Id: BFA01C001F Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=d6ZDNCAc; spf=pass (imf28.hostedemail.com: domain of vbabka@kernel.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=vbabka@kernel.org; dmarc=pass (policy=none) header.from=kernel.org X-Stat-Signature: yw6wktymnw5wjw16tkphoe4fcogdq9gi X-Rspamd-Server: rspam03 X-HE-Tag: 1666693070-731670 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 9/28/22 14:01, Alistair Popple wrote: > This series aims to fix a number of page reference counting issues in > drivers dealing with device private ZONE_DEVICE pages. These result in > use-after-free type bugs, either from accessing a struct page which no > longer exists because it has been removed or accessing fields within the > struct page which are no longer valid because the page has been freed. > > During normal usage it is unlikely these will cause any problems. However > without these fixes it is possible to crash the kernel from userspace. > These crashes can be triggered either by unloading the kernel module or > unbinding the device from the driver prior to a userspace task exiting. In > modules such as Nouveau it is also possible to trigger some of these issues > by explicitly closing the device file-descriptor prior to the task exiting > and then accessing device private memory. Hi, as this series was noticed to create a CVE [1], do you think a stable backport is warranted? I think the "It is possible to launch the attack remotely." in [1] is incorrect though, right? It looks to me that patch 1 would be needed since the CONFIG_DEVICE_PRIVATE introduction, while the following few only to kernels with 27674ef6c73f (probably not so critical as that includes no LTS)? Thanks, Vlastimil [1] https://nvd.nist.gov/vuln/detail/CVE-2022-3523 > This involves some minor changes to both PowerPC and AMD GPU code. > Unfortunately I lack hardware to test either of those so any help there > would be appreciated. The changes mimic what is done in for both Nouveau > and hmm-tests though so I doubt they will cause problems. > > To: Andrew Morton > To: linux-mm@kvack.org > Cc: linux-kernel@vger.kernel.org > Cc: amd-gfx@lists.freedesktop.org > Cc: nouveau@lists.freedesktop.org > Cc: dri-devel@lists.freedesktop.org > > Alistair Popple (8): > mm/memory.c: Fix race when faulting a device private page > mm: Free device private pages have zero refcount > mm/memremap.c: Take a pgmap reference on page allocation > mm/migrate_device.c: Refactor migrate_vma and migrate_deivce_coherent_page() > mm/migrate_device.c: Add migrate_device_range() > nouveau/dmem: Refactor nouveau_dmem_fault_copy_one() > nouveau/dmem: Evict device private memory during release > hmm-tests: Add test for migrate_device_range() > > arch/powerpc/kvm/book3s_hv_uvmem.c | 17 +- > drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 19 +- > drivers/gpu/drm/amd/amdkfd/kfd_migrate.h | 2 +- > drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 11 +- > drivers/gpu/drm/nouveau/nouveau_dmem.c | 108 +++++++---- > include/linux/memremap.h | 1 +- > include/linux/migrate.h | 15 ++- > lib/test_hmm.c | 129 ++++++++++--- > lib/test_hmm_uapi.h | 1 +- > mm/memory.c | 16 +- > mm/memremap.c | 30 ++- > mm/migrate.c | 34 +-- > mm/migrate_device.c | 239 +++++++++++++++++------- > mm/page_alloc.c | 8 +- > tools/testing/selftests/vm/hmm-tests.c | 49 +++++- > 15 files changed, 516 insertions(+), 163 deletions(-) > > base-commit: 088b8aa537c2c767765f1c19b555f21ffe555786