From: John Hubbard <jhubbard@nvidia.com>
To: Andrew Morton <akpm@linux-foundation.org>,
Peter Xu <peterx@redhat.com>, Jason Gunthorpe <jgg@ziepe.ca>
Cc: David Hildenbrand <david@redhat.com>,
Lukas Bulwahn <lukas.bulwahn@gmail.com>,
Claudio Imbrenda <imbrenda@linux.ibm.com>,
Christoph Hellwig <hch@infradead.org>,
Matthew Wilcox <willy@infradead.org>, Jan Kara <jack@suse.cz>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Alex Williamson <alex.williamson@redhat.com>,
Andrea Arcangeli <aarcange@redhat.com>,
LKML <linux-kernel@vger.kernel.org>, <linux-mm@kvack.org>,
John Hubbard <jhubbard@nvidia.com>,
Christoph Hellwig <hch@lst.de>
Subject: [PATCH v5 1/5] mm: Fix invalid page pointer returned with FOLL_PIN gups
Date: Sun, 6 Feb 2022 22:22:09 -0800 [thread overview]
Message-ID: <20220207062213.235127-2-jhubbard@nvidia.com> (raw)
In-Reply-To: <20220207062213.235127-1-jhubbard@nvidia.com>
From: Peter Xu <peterx@redhat.com>
Alex reported invalid page pointer returned with pin_user_pages_remote()
from vfio after upstream commit 4b6c33b32296 ("vfio/type1: Prepare for
batched pinning with struct vfio_batch").
It turns out that it's not the fault of the vfio commit; however after
vfio switches to a full page buffer to store the page pointers it starts
to expose the problem easier.
The problem is for VM_PFNMAP vmas we should normally fail with an
-EFAULT then vfio will carry on to handle the MMIO regions. However
when the bug triggered, follow_page_mask() returned -EEXIST for such a
page, which will jump over the current page, leaving that entry in
**pages untouched. However the caller is not aware of it, hence the
caller will reference the page as usual even if the pointer data can be
anything.
We had that -EEXIST logic since commit 1027e4436b6a ("mm: make GUP
handle pfn mapping unless FOLL_GET is requested") which seems very
reasonable. It could be that when we reworked GUP with FOLL_PIN we
could have overlooked that special path in commit 3faa52c03f44 ("mm/gup:
track FOLL_PIN pages"), even if that commit rightfully touched up
follow_devmap_pud() on checking FOLL_PIN when it needs to return an
-EEXIST.
Attaching the Fixes to the FOLL_PIN rework commit, as it happened later
than 1027e4436b6a.
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Fixes: 3faa52c03f44 ("mm/gup: track FOLL_PIN pages")
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Reported-by: Alex Williamson <alex.williamson@redhat.com>
Debugged-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
[jhubbard: added some tags, removed a reference to an out of tree
module, and reflowed to 72 columns.]
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
---
mm/gup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/gup.c b/mm/gup.c
index a9d4d724aef7..80229ecf0114 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -465,7 +465,7 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
pte_t *pte, unsigned int flags)
{
/* No page to get reference */
- if (flags & FOLL_GET)
+ if (flags & (FOLL_GET | FOLL_PIN))
return -EFAULT;
if (flags & FOLL_TOUCH) {
--
2.35.1
next prev parent reply other threads:[~2022-02-07 6:31 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-07 6:22 [PATCH v5 0/5] mm/gup: some cleanups John Hubbard
2022-02-07 6:22 ` John Hubbard [this message]
2022-02-07 6:22 ` [PATCH v5 2/5] mm/gup: follow_pfn_pte(): -EEXIST cleanup John Hubbard
2022-02-07 6:22 ` [PATCH v5 3/5] mm/gup: remove unused pin_user_pages_locked() John Hubbard
2022-02-07 6:22 ` [PATCH v5 4/5] mm: change lookup_node() to use get_user_pages_fast() John Hubbard
2022-02-07 6:22 ` [PATCH v5 5/5] mm/gup: remove unused get_user_pages_locked() John Hubbard
2022-02-12 0:24 ` [PATCH v5 0/5] mm/gup: some cleanups John Hubbard
2022-02-12 0:27 ` Andrew Morton
2022-02-12 0:30 ` John Hubbard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220207062213.235127-2-jhubbard@nvidia.com \
--to=jhubbard@nvidia.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=alex.williamson@redhat.com \
--cc=david@redhat.com \
--cc=hch@infradead.org \
--cc=hch@lst.de \
--cc=imbrenda@linux.ibm.com \
--cc=jack@suse.cz \
--cc=jgg@ziepe.ca \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lukas.bulwahn@gmail.com \
--cc=peterx@redhat.com \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).