From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B03DC2D0A3 for ; Fri, 6 Nov 2020 15:55:30 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7054222202 for ; Fri, 6 Nov 2020 15:55:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=nvidia.com header.i=@nvidia.com header.b="nl5yiRr7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7054222202 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=nvidia.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 5E1796B0068; Fri, 6 Nov 2020 10:55:27 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 591926B006E; Fri, 6 Nov 2020 10:55:27 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 486FA6B0070; Fri, 6 Nov 2020 10:55:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0065.hostedemail.com [216.40.44.65]) by kanga.kvack.org (Postfix) with ESMTP id F01A46B0068 for ; Fri, 6 Nov 2020 10:55:26 -0500 (EST) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 90155180AD820 for ; Fri, 6 Nov 2020 15:55:26 +0000 (UTC) X-FDA: 77454443052.05.wren55_0913862272d3 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin05.hostedemail.com (Postfix) with ESMTP id 769AA1803042D for ; Fri, 6 Nov 2020 15:55:26 +0000 (UTC) X-HE-Tag: wren55_0913862272d3 X-Filterd-Recvd-Size: 12685 Received: from nat-hk.nvidia.com (nat-hk.nvidia.com [203.18.50.4]) by imf41.hostedemail.com (Postfix) with ESMTP for ; Fri, 6 Nov 2020 15:55:24 +0000 (UTC) Received: from HKMAIL101.nvidia.com (Not Verified[10.18.92.100]) by nat-hk.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Fri, 06 Nov 2020 23:55:19 +0800 Received: from HKMAIL104.nvidia.com (10.18.16.13) by HKMAIL101.nvidia.com (10.18.16.10) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 6 Nov 2020 15:55:19 +0000 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (104.47.36.55) by HKMAIL104.nvidia.com (10.18.16.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 6 Nov 2020 15:55:19 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=VORFNo6u8CFP2jMPmY1iK8EVtYf8wq+58J53KI77s4rR5essLi0tsph2IyZwfLNmVFB8do2TkhCjRO6lRJY35QVymjgYRE3n9s6tTQLgXzdxXyJngCJU0R8UthcTZgovNv36PZjSsp90NZkj0+DZ+3dLu8dozURQd2JAhxDvnvQUuu6Y/L9ngsDGFGrq9snZpQar/ubWUXupBZPWVPzqCDcxUFfCfG/xbXtEiJOwu6ZxarSVByfSV5+OC5BJpEXfyG8kDyTv/JXVFZx3XTKdAMR8yA3TDgxqWPrp49wPuu98MtPjLo9fbHK86WRieI1cfPDg+E5OOSitzdfpLS+ldA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1AStHnvPMOyIsoEKixZa0TFALuGZcZpelbe4cI499Bw=; b=L625jo7zAqTibHmyaHg36xBRqGfME16Jc2oHfmrmEGdOZ+foihDxddRoV6UkI3VboUpHW17rqFgtM+slGkLDfChwszLfZjWN649iJ633/BPjCE9y4CA6WorkP0TqIxueYgbcM+yLEFAMlJhtFFrA/+0elpHX6ynITD5jrEi5k2LwWWfmuP8R4F7WJaCPX8tPYmZT+mCuFoVNhTkouOPHwFvp3DGVlO9dFSGGYxCBAY9h7KMJX5lnHBVRD+vX7XN9/zT9+uS8XMxSh8kaMIiedyvyDt1k2CRaDlSGkxTHo5RwfPkJwPklas0d3s+0AShl8XlO+COcM9hgEyFgrhWjLw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none Received: from DM6PR12MB3834.namprd12.prod.outlook.com (2603:10b6:5:14a::12) by DM6PR12MB4617.namprd12.prod.outlook.com (2603:10b6:5:35::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18; Fri, 6 Nov 2020 15:55:17 +0000 Received: from DM6PR12MB3834.namprd12.prod.outlook.com ([fe80::cdbe:f274:ad65:9a78]) by DM6PR12MB3834.namprd12.prod.outlook.com ([fe80::cdbe:f274:ad65:9a78%7]) with mapi id 15.20.3499.032; Fri, 6 Nov 2020 15:55:17 +0000 From: Jason Gunthorpe To: , Peter Xu , Linus Torvalds CC: "Ahmed S. Darwish" , Andrea Arcangeli , Andrew Morton , Aneesh Kumar K.V , Christoph Hellwig , Hugh Dickins , Jan Kara , Jann Horn , John Hubbard , Kirill Shutemov , Kirill Tkhai , Leon Romanovsky , Linux-MM , Michal Hocko , Oleg Nesterov Subject: [PATCH v3 2/2] mm: prevent gup_fast from racing with COW during fork Date: Fri, 6 Nov 2020 11:55:14 -0400 Message-ID: <2-v3-7358966cab09+14e9-gup_fork_jgg@nvidia.com> In-Reply-To: <0-v3-7358966cab09+14e9-gup_fork_jgg@nvidia.com> References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain X-ClientProxiedBy: BL0PR1501CA0028.namprd15.prod.outlook.com (2603:10b6:207:17::41) To DM6PR12MB3834.namprd12.prod.outlook.com (2603:10b6:5:14a::12) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from mlx.ziepe.ca (156.34.48.30) by BL0PR1501CA0028.namprd15.prod.outlook.com (2603:10b6:207:17::41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3541.21 via Frontend Transport; Fri, 6 Nov 2020 15:55:15 +0000 Received: from jgg by mlx with local (Exim 4.94) (envelope-from ) id 1kb454-000vSs-EL; Fri, 06 Nov 2020 11:55:14 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1604678119; bh=X4h9/pgiphlRRUl4H+daEIBmTnZbBpy7UZAGDZalydI=; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To: CC:Subject:Date:Message-ID:In-Reply-To:References: Content-Transfer-Encoding:Content-Type:X-ClientProxiedBy: MIME-Version:X-MS-Exchange-MessageSentRepresentingType; b=nl5yiRr7xD0t6dfv0Ftv5qmwvqu5Z9UcoJhgm1UaPN9oHfAGFnwV6L4WsIYdu8grm EzuFzOeygqEU8UqaeYszH6w2WxlyOlmRw/r9YVyzRrKhV12O4dw423nsB4kqeINV4L MIJ7V2ukQuVykDAgobHEJyBluJfkY83fjGGjHW0cSm7C0GINKuDijh2ztevMd5JMoJ 270GuFsPxtPfFtwoE6Ya9qcGptI+DWr6+vP6QpuGlCo/qkg2hB7ubuFQARU0ER5hdh KoD+XqYJmzNLLnaZ+hHMuVzf/hhV00asL7n8sEur/hqPPJFAEfsFKM8uQGrMj4D9z7 cXxZZC+iuY41A== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Since commit 70e806e4e645 ("mm: Do early cow for pinned pages during fork() for ptes") pages under a FOLL_PIN will not be write protected during COW for fork. This means that pages returned from pin_user_pages(FOLL_WRITE) should not become write protected while the pin is active. However, there is a small race where get_user_pages_fast(FOLL_PIN) can establish a FOLL_PIN at the same time copy_present_page() is write protecting it: CPU 0 CPU 1 get_user_pages_fast() internal_get_user_pages_fast() copy_page_range() pte_alloc_map_lock() copy_present_page() atomic_read(has_pinned) =3D=3D= 0 page_maybe_dma_pinned() =3D=3D false atomic_set(has_pinned, 1); gup_pgd_range() gup_pte_range() pte_t pte =3D gup_get_pte(ptep) pte_access_permitted(pte) try_grab_compound_head() pte =3D pte_wrprotect(pte) set_pte_at(); pte_unmap_unlock() // GUP now returns with a write protected page The first attempt to resolve this by using the write protect caused problems (and was missing a barrrier), see commit f3c64eda3e50 ("mm: avoid early COW write protect games during fork()") Instead wrap copy_p4d_range() with the write side of a seqcount and check the read side around gup_pgd_range(). If there is a collision then get_user_pages_fast() fails and falls back to slow GUP. Slow GUP is safe against this race because copy_page_range() is only called while holding the exclusive side of the mmap_lock on the src mm_struct. Fixes: f3c64eda3e50 ("mm: avoid early COW write protect games during fork()= ") Suggested-by: Linus Torvalds Link: https://lore.kernel.org/r/CAHk-=3Dwi=3DiCnYCARbPGjkVJu9eyYeZ13N64tZYL= dOB8CP5Q_PLw@mail.gmail.com Reviewed-by: John Hubbard Reviewed-by: Jan Kara Signed-off-by: Jason Gunthorpe --- arch/x86/kernel/tboot.c | 1 + drivers/firmware/efi/efi.c | 1 + include/linux/mm_types.h | 8 ++++++++ kernel/fork.c | 1 + mm/gup.c | 19 +++++++++++++++++++ mm/init-mm.c | 1 + mm/memory.c | 13 ++++++++++++- 7 files changed, 43 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c index 992fb1415c0f1f..6a2f542d9588a4 100644 --- a/arch/x86/kernel/tboot.c +++ b/arch/x86/kernel/tboot.c @@ -93,6 +93,7 @@ static struct mm_struct tboot_mm =3D { .pgd =3D swapper_pg_dir, .mm_users =3D ATOMIC_INIT(2), .mm_count =3D ATOMIC_INIT(1), + .write_protect_seq =3D SEQCNT_ZERO(tboot_mm.write_protect_seq), MMAP_LOCK_INITIALIZER(init_mm) .page_table_lock =3D __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), .mmlist =3D LIST_HEAD_INIT(init_mm.mmlist), diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 5e5480a0a32d7d..2520f6e05f4d44 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -57,6 +57,7 @@ struct mm_struct efi_mm =3D { .mm_rb =3D RB_ROOT, .mm_users =3D ATOMIC_INIT(2), .mm_count =3D ATOMIC_INIT(1), + .write_protect_seq =3D SEQCNT_ZERO(efi_mm.write_protect_seq), MMAP_LOCK_INITIALIZER(efi_mm) .page_table_lock =3D __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock), .mmlist =3D LIST_HEAD_INIT(efi_mm.mmlist), diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 5a9238f6caad97..915f4f100383b5 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -14,6 +14,7 @@ #include #include #include +#include =20 #include =20 @@ -446,6 +447,13 @@ struct mm_struct { */ atomic_t has_pinned; =20 + /** + * @write_protect_seq: Locked when any thread is write + * protecting pages mapped by this mm to enforce a later COW, + * for instance during page table copying for fork(). + */ + seqcount_t write_protect_seq; + #ifdef CONFIG_MMU atomic_long_t pgtables_bytes; /* PTE page table pages */ #endif diff --git a/kernel/fork.c b/kernel/fork.c index 32083db7a2a23e..6fd934a6d60d96 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm= , struct task_struct *p, mm->vmacache_seqnum =3D 0; atomic_set(&mm->mm_users, 1); atomic_set(&mm->mm_count, 1); + seqcount_init(&mm->write_protect_seq); mmap_init_lock(mm); INIT_LIST_HEAD(&mm->mmlist); mm->core_state =3D NULL; diff --git a/mm/gup.c b/mm/gup.c index c7e24301860abb..f2643058f93a83 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -2684,11 +2684,18 @@ static unsigned long lockless_pages_from_mm(unsigne= d long start, { unsigned long flags; int nr_pinned =3D 0; + unsigned seq; =20 if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) || !gup_fast_permitted(start, end)) return 0; =20 + if (gup_flags & FOLL_PIN) { + seq =3D raw_read_seqcount(¤t->mm->write_protect_seq); + if (seq & 1) + return 0; + } + /* * Disable interrupts. The nested form is used, in order to allow full, * general purpose use of this routine. @@ -2703,6 +2710,18 @@ static unsigned long lockless_pages_from_mm(unsigned= long start, local_irq_save(flags); gup_pgd_range(start, end, gup_flags, pages, &nr_pinned); local_irq_restore(flags); + + /* + * When pinning pages for DMA there could be a concurrent write protect + * from fork() via copy_page_range(), in this case always fail fast GUP. + */ + if (gup_flags & FOLL_PIN) { + if (read_seqcount_t_retry(¤t->mm->write_protect_seq, + seq)) { + unpin_user_pages(pages, nr_pinned); + return 0; + } + } return nr_pinned; } =20 diff --git a/mm/init-mm.c b/mm/init-mm.c index 3a613c85f9ede2..153162669f8062 100644 --- a/mm/init-mm.c +++ b/mm/init-mm.c @@ -31,6 +31,7 @@ struct mm_struct init_mm =3D { .pgd =3D swapper_pg_dir, .mm_users =3D ATOMIC_INIT(2), .mm_count =3D ATOMIC_INIT(1), + .write_protect_seq =3D SEQCNT_ZERO(init_mm.write_protect_seq), MMAP_LOCK_INITIALIZER(init_mm) .page_table_lock =3D __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), .arg_lock =3D __SPIN_LOCK_UNLOCKED(init_mm.arg_lock), diff --git a/mm/memory.c b/mm/memory.c index c48f8df6e50268..783aabfa66d29f 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1171,6 +1171,15 @@ copy_page_range(struct vm_area_struct *dst_vma, stru= ct vm_area_struct *src_vma) mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE, 0, src_vma, src_mm, addr, end); mmu_notifier_invalidate_range_start(&range); + /* + * Disabling preemption is not needed for the write side, as + * the read side doesn't spin, but goes to the mmap_lock. + * + * Use the raw variant of the seqcount_t write API to avoid + * lockdep complaining about preemptibility. + */ + mmap_assert_write_locked(src_mm); + raw_write_seqcount_begin(&src_mm->write_protect_seq); } =20 ret =3D 0; @@ -1187,8 +1196,10 @@ copy_page_range(struct vm_area_struct *dst_vma, stru= ct vm_area_struct *src_vma) } } while (dst_pgd++, src_pgd++, addr =3D next, addr !=3D end); =20 - if (is_cow) + if (is_cow) { + raw_write_seqcount_end(&src_mm->write_protect_seq); mmu_notifier_invalidate_range_end(&range); + } return ret; } =20 --=20 2.29.2