linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] mm,memory_failure: Always pin the page in madvise_inject_error
@ 2020-12-07  9:48 Oscar Salvador
  2020-12-08  2:22 ` Andrew Morton
  2020-12-08  2:35 ` HORIGUCHI NAOYA(堀口 直也)
  0 siblings, 2 replies; 4+ messages in thread
From: Oscar Salvador @ 2020-12-07  9:48 UTC (permalink / raw)
  To: akpm
  Cc: n-horiguchi, vbabka, dan.j.williams, linux-mm, linux-kernel,
	Oscar Salvador

madvise_inject_error() uses get_user_pages_fast to translate the
address we specified to a page.
After [1], we drop the extra reference count for memory_failure() path.
That commit says that memory_failure wanted to keep the pin in order
to take the page out of circulation.

The truth is that we need to keep the page pinned, otherwise the
page might be re-used after the put_page() and we can end up messing
with someone else's memory.

E.g:

CPU0
process X					CPU1
 madvise_inject_error
  get_user_pages
   put_page
					page gets reclaimed
					process Y allocates the page
  memory_failure
   // We mess with process Y memory

madvise() is meant to operate on a self address space, so messing with
pages that do not belong to us seems the wrong thing to do.
To avoid that, let us keep the page pinned for memory_failure as well.

Pages for DAX mappings will release this extra refcount in
memory_failure_dev_pagemap.

[1] ("23e7b5c2e271: mm, madvise_inject_error:
      Let memory_failure() optionally take a page reference")

Signed-off-by: Oscar Salvador <osalvador@suse.de>
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Fixes: 23e7b5c2e271 ("mm, madvise_inject_error: Let memory_failure() optionally take a page reference")
---
 mm/madvise.c        | 9 +--------
 mm/memory-failure.c | 6 ++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index c6b5524add58..19edddba196d 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -907,14 +907,7 @@ static int madvise_inject_error(int behavior,
 		} else {
 			pr_info("Injecting memory failure for pfn %#lx at process virtual address %#lx\n",
 				 pfn, start);
-			/*
-			 * Drop the page reference taken by get_user_pages_fast(). In
-			 * the absence of MF_COUNT_INCREASED the memory_failure()
-			 * routine is responsible for pinning the page to prevent it
-			 * from being released back to the page allocator.
-			 */
-			put_page(page);
-			ret = memory_failure(pfn, 0);
+			ret = memory_failure(pfn, MF_COUNT_INCREASED);
 		}
 
 		if (ret)
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 869ece2a1de2..064d605cc416 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1258,6 +1258,12 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
 	loff_t start;
 	dax_entry_t cookie;
 
+	if (flags & MF_COUNT_INCREASED)
+		/*
+		 * Drop the extra refcount in case we come from madvise().
+		 */
+		put_page(page);
+
 	/*
 	 * Prevent the inode from being freed while we are interrogating
 	 * the address_space, typically this would be handled by
-- 
2.26.2



^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH] mm,memory_failure: Always pin the page in madvise_inject_error
  2020-12-07  9:48 [PATCH] mm,memory_failure: Always pin the page in madvise_inject_error Oscar Salvador
@ 2020-12-08  2:22 ` Andrew Morton
  2020-12-08  2:34   ` HORIGUCHI NAOYA(堀口 直也)
  2020-12-08  2:35 ` HORIGUCHI NAOYA(堀口 直也)
  1 sibling, 1 reply; 4+ messages in thread
From: Andrew Morton @ 2020-12-08  2:22 UTC (permalink / raw)
  To: Oscar Salvador
  Cc: n-horiguchi, vbabka, dan.j.williams, linux-mm, linux-kernel

On Mon,  7 Dec 2020 10:48:18 +0100 Oscar Salvador <osalvador@suse.de> wrote:

> madvise_inject_error() uses get_user_pages_fast to translate the
> address we specified to a page.
> After [1], we drop the extra reference count for memory_failure() path.
> That commit says that memory_failure wanted to keep the pin in order
> to take the page out of circulation.
> 
> The truth is that we need to keep the page pinned, otherwise the
> page might be re-used after the put_page() and we can end up messing
> with someone else's memory.
> 
> E.g:
> 
> CPU0
> process X					CPU1
>  madvise_inject_error
>   get_user_pages
>    put_page
> 					page gets reclaimed
> 					process Y allocates the page
>   memory_failure
>    // We mess with process Y memory
> 
> madvise() is meant to operate on a self address space, so messing with
> pages that do not belong to us seems the wrong thing to do.
> To avoid that, let us keep the page pinned for memory_failure as well.
> 
> Pages for DAX mappings will release this extra refcount in
> memory_failure_dev_pagemap.

Does the bug have any known user-visible effects?  Is a deliberate
exploit conceivable?

IOW, cc:stable and if so, why?


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] mm,memory_failure: Always pin the page in madvise_inject_error
  2020-12-08  2:22 ` Andrew Morton
@ 2020-12-08  2:34   ` HORIGUCHI NAOYA(堀口 直也)
  0 siblings, 0 replies; 4+ messages in thread
From: HORIGUCHI NAOYA(堀口 直也) @ 2020-12-08  2:34 UTC (permalink / raw)
  To: Andrew Morton
  Cc: Oscar Salvador, n-horiguchi, vbabka, dan.j.williams, linux-mm,
	linux-kernel

On Mon, Dec 07, 2020 at 06:22:00PM -0800, Andrew Morton wrote:
> On Mon,  7 Dec 2020 10:48:18 +0100 Oscar Salvador <osalvador@suse.de> wrote:
> 
> > madvise_inject_error() uses get_user_pages_fast to translate the
> > address we specified to a page.
> > After [1], we drop the extra reference count for memory_failure() path.
> > That commit says that memory_failure wanted to keep the pin in order
> > to take the page out of circulation.
> > 
> > The truth is that we need to keep the page pinned, otherwise the
> > page might be re-used after the put_page() and we can end up messing
> > with someone else's memory.
> > 
> > E.g:
> > 
> > CPU0
> > process X					CPU1
> >  madvise_inject_error
> >   get_user_pages
> >    put_page
> > 					page gets reclaimed
> > 					process Y allocates the page
> >   memory_failure
> >    // We mess with process Y memory
> > 
> > madvise() is meant to operate on a self address space, so messing with
> > pages that do not belong to us seems the wrong thing to do.
> > To avoid that, let us keep the page pinned for memory_failure as well.
> > 
> > Pages for DAX mappings will release this extra refcount in
> > memory_failure_dev_pagemap.
> 
> Does the bug have any known user-visible effects?  Is a deliberate
> exploit conceivable?
> 
> IOW, cc:stable and if so, why?

This interface is a testing feature and only available only for privileged
(CAP_SYS_ADMIN) users, so I don't think that this bug is critical. But if
someone think it need to go to stable, I'm fine with that.

Thanks,
Naoya Horiguchi

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] mm,memory_failure: Always pin the page in madvise_inject_error
  2020-12-07  9:48 [PATCH] mm,memory_failure: Always pin the page in madvise_inject_error Oscar Salvador
  2020-12-08  2:22 ` Andrew Morton
@ 2020-12-08  2:35 ` HORIGUCHI NAOYA(堀口 直也)
  1 sibling, 0 replies; 4+ messages in thread
From: HORIGUCHI NAOYA(堀口 直也) @ 2020-12-08  2:35 UTC (permalink / raw)
  To: Oscar Salvador
  Cc: akpm, n-horiguchi, vbabka, dan.j.williams, linux-mm, linux-kernel

On Mon, Dec 07, 2020 at 10:48:18AM +0100, Oscar Salvador wrote:
> madvise_inject_error() uses get_user_pages_fast to translate the
> address we specified to a page.
> After [1], we drop the extra reference count for memory_failure() path.
> That commit says that memory_failure wanted to keep the pin in order
> to take the page out of circulation.
> 
> The truth is that we need to keep the page pinned, otherwise the
> page might be re-used after the put_page() and we can end up messing
> with someone else's memory.
> 
> E.g:
> 
> CPU0
> process X					CPU1
>  madvise_inject_error
>   get_user_pages
>    put_page
> 					page gets reclaimed
> 					process Y allocates the page
>   memory_failure
>    // We mess with process Y memory
> 
> madvise() is meant to operate on a self address space, so messing with
> pages that do not belong to us seems the wrong thing to do.
> To avoid that, let us keep the page pinned for memory_failure as well.
> 
> Pages for DAX mappings will release this extra refcount in
> memory_failure_dev_pagemap.
> 
> [1] ("23e7b5c2e271: mm, madvise_inject_error:
>       Let memory_failure() optionally take a page reference")
> 
> Signed-off-by: Oscar Salvador <osalvador@suse.de>
> Suggested-by: Vlastimil Babka <vbabka@suse.cz>
> Fixes: 23e7b5c2e271 ("mm, madvise_inject_error: Let memory_failure() optionally take a page reference")

Thank you very much.

Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2020-12-08  2:35 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-07  9:48 [PATCH] mm,memory_failure: Always pin the page in madvise_inject_error Oscar Salvador
2020-12-08  2:22 ` Andrew Morton
2020-12-08  2:34   ` HORIGUCHI NAOYA(堀口 直也)
2020-12-08  2:35 ` HORIGUCHI NAOYA(堀口 直也)

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).