linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
From: Mike Kravetz <mike.kravetz@oracle.com>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: syzbot <syzbot+d6ec23007e951dadf3de@syzkaller.appspotmail.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-mm@kvack.org, Miklos Szeredi <mszeredi@redhat.com>,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
	Al Viro <viro@zeniv.linux.org.uk>
Subject: Re: kernel BUG at mm/hugetlb.c:LINE!
Date: Mon, 18 May 2020 16:22:08 -0700	[thread overview]
Message-ID: <04a00e3b-539c-236f-e43b-0024ef94b7cb@oracle.com> (raw)
In-Reply-To: <CAJfpegsy5vzO5e3DJGTrpXoGRTzjegoLaDdzheDeQhw+uokYnQ@mail.gmail.com>

On 5/18/20 4:12 AM, Miklos Szeredi wrote:
> On Sat, May 16, 2020 at 12:15 AM Mike Kravetz <mike.kravetz@oracle.com> wrote:
>> Any suggestions on how to move forward?  It seems like there may be the
>> need for a real_file() routine?  I see a d_real dentry_op was added to
>> deal with this issue for dentries.  Might we need something similiar for
>> files (f_real)?
>>
>> Looking for suggestions as I do not normally work with this code.
> 
> And I'm not so familiar with hugepages code.  I'd suggest moving
> length alignment into f_op->get_unmapped_area() and cleaning up other
> special casing of hugetlb mappings, but it's probably far from
> trivial...
> 
> So yeah, that leaves a real_file() helper or something similar.
> Unlike the example I gave first it actually needs to be recursive:
> 
> static inline struct file *real_file(struct file *file)
> {
>     whole (unlikely(file->f_op == ovl_file_operations))
>         file = file->private_data;
>     return file;
> }

If we add real_file(), then I think it only needs to be called in two
places: is_file_hugepages() and core mmap code.  However, I could not
think of a good place to put real_file().  Below is a patch which creates
a new file <linux/overlayfs.h> for the routine.  It does solve this BUG
and should fix any other issues with callers of is_file_hugepages().
Let me know what you think.

I add a 'Suggested-by:' for real_file, but am happy to change that to
a 'Signed-off-by:' if you prefer.

From ea6a96aa3f5365df39f7cf213f87abe336b43e71 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz@oracle.com>
Date: Mon, 18 May 2020 15:29:12 -0700
Subject: [PATCH] ovl: provide real_file() for use by hugetlb and mmap

If a file is on a union/overlay, then the 'struct file *' will have
overlayfs file operations.  The routine is_file_hugepages() compares
f->f_op to hugetlbfs_file_operations to determine if it is a hugetlbfs
file.  If a hugetlbfs file is on a union/overlay, this comparison is
false and is_file_hugepages() incorrectly indicates the underlying
file is not hugetlbfs.  One result of this is a BUG as shown in [1].

mmap uses is_file_hugepages() because hugetlbfs files have different
alignment restrictions.  In addition, mmap code would like to use the
filesystem specific get_unmapped_area() routine if one is defined.

To address this issue, add a new routine real_file() which will return
the underlying file.  Update is_file_hugepages and mmap code to get the
real file.

[1] https://lore.kernel.org/linux-mm/000000000000b4684e05a2968ca6@google.com/

Reported-by: syzbot+d6ec23007e951dadf3de@syzkaller.appspotmail.com
Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
---
 include/linux/hugetlb.h   |  3 +++
 include/linux/overlayfs.h | 27 +++++++++++++++++++++++++++
 mm/mmap.c                 |  2 ++
 3 files changed, 32 insertions(+)
 create mode 100644 include/linux/overlayfs.h

diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 43a1cef8f0f1..fb22c0a7474a 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -9,6 +9,7 @@
 #include <linux/cgroup.h>
 #include <linux/list.h>
 #include <linux/kref.h>
+#include <linux/overlayfs.h>
 #include <asm/pgtable.h>
 
 struct ctl_table;
@@ -437,6 +438,8 @@ struct file *hugetlb_file_setup(const char *name, size_t size, vm_flags_t acct,
 
 static inline bool is_file_hugepages(struct file *file)
 {
+	file = real_file(file);
+
 	if (file->f_op == &hugetlbfs_file_operations)
 		return true;
 
diff --git a/include/linux/overlayfs.h b/include/linux/overlayfs.h
new file mode 100644
index 000000000000..eecdfda0286f
--- /dev/null
+++ b/include/linux/overlayfs.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_OVERLAYFS_H
+#define _LINUX_OVERLAYFS_H
+
+#include <linux/fs.h>
+
+extern const struct file_operations ovl_file_operations;
+
+#ifdef CONFIG_OVERLAY_FS
+/*
+ * If file is on a union/overlay, then return the underlying real file.
+ * Otherwise return the file itself.
+ */
+static inline struct file *real_file(struct file *file)
+{
+	while (unlikely(file->f_op == &ovl_file_operations))
+		file = file->private_data;
+	return file;
+}
+#else
+static inline struct file *real_file(struct file *file)
+{
+	return file;
+}
+#endif
+
+#endif /* _LINUX_OVERLAYFS_H */
diff --git a/mm/mmap.c b/mm/mmap.c
index f609e9ec4a25..7f45a4057a15 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -47,6 +47,7 @@
 #include <linux/pkeys.h>
 #include <linux/oom.h>
 #include <linux/sched/mm.h>
+#include <linux/overlayfs.h>
 
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
@@ -2203,6 +2204,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
 
 	get_area = current->mm->get_unmapped_area;
 	if (file) {
+		file = real_file(file);
 		if (file->f_op->get_unmapped_area)
 			get_area = file->f_op->get_unmapped_area;
 	} else if (flags & MAP_SHARED) {
-- 
2.25.4



  reply	other threads:[~2020-05-18 23:24 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-06  3:06 syzbot
2020-04-06 22:05 ` Mike Kravetz
2020-05-12 15:04   ` Miklos Szeredi
2020-05-12 18:11     ` Mike Kravetz
2020-05-15 22:15       ` Mike Kravetz
2020-05-18 11:12         ` Miklos Szeredi
2020-05-18 23:22           ` Mike Kravetz [this message]
2020-05-18 23:41     ` Colin Walters
2020-05-19  0:35       ` Mike Kravetz
2020-05-20 11:20         ` Miklos Szeredi
2020-05-20 17:27           ` Mike Kravetz
2020-05-22 10:05             ` Miklos Szeredi
2020-05-28  0:01               ` Mike Kravetz
2020-05-28  8:37                 ` [PATCH v2] ovl: provide real_file() and overlayfs get_unmapped_area() kbuild test robot
2020-05-28 21:01                   ` Mike Kravetz
2020-06-04  9:16                     ` Miklos Szeredi
2020-06-11  0:13                       ` Mike Kravetz
2020-06-11  0:37                         ` Al Viro
2020-06-11  1:36                           ` Matthew Wilcox
2020-06-11  2:17                             ` Al Viro
2020-06-11  2:31                               ` Mike Kravetz

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=04a00e3b-539c-236f-e43b-0024ef94b7cb@oracle.com \
    --to=mike.kravetz@oracle.com \
    --cc=akpm@linux-foundation.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=miklos@szeredi.hu \
    --cc=mszeredi@redhat.com \
    --cc=syzbot+d6ec23007e951dadf3de@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    --subject='Re: kernel BUG at mm/hugetlb.c:LINE'\!'' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).