From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5487C433DB for ; Mon, 21 Dec 2020 23:13:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 614FC22B51 for ; Mon, 21 Dec 2020 23:13:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 614FC22B51 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id B48A76B0036; Mon, 21 Dec 2020 18:13:35 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B1FB76B005C; Mon, 21 Dec 2020 18:13:35 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A36366B0071; Mon, 21 Dec 2020 18:13:35 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0143.hostedemail.com [216.40.44.143]) by kanga.kvack.org (Postfix) with ESMTP id 8AD4D6B0036 for ; Mon, 21 Dec 2020 18:13:35 -0500 (EST) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 57B581DED for ; Mon, 21 Dec 2020 23:13:35 +0000 (UTC) X-FDA: 77618843190.05.heart97_34014e42745b Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin05.hostedemail.com (Postfix) with ESMTP id 3BB0418026A09 for ; Mon, 21 Dec 2020 23:13:35 +0000 (UTC) X-HE-Tag: heart97_34014e42745b X-Filterd-Recvd-Size: 4656 Received: from mail-lf1-f49.google.com (mail-lf1-f49.google.com [209.85.167.49]) by imf17.hostedemail.com (Postfix) with ESMTP for ; Mon, 21 Dec 2020 23:13:34 +0000 (UTC) Received: by mail-lf1-f49.google.com with SMTP id o17so27669130lfg.4 for ; Mon, 21 Dec 2020 15:13:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=f06zvCtNpwfTL+4Itq4rCpQRN53L0BPN7ECqHQNOVpQ=; b=YPEH2Xb2Ow8JmzRAuCKa272elvNzGdaJcJVbXOAswsyaU1vW/qvS3mZEvPQgkSsF4g 3oN6qkAJWfGl+PmPsyxxPFKtVeKvVltnzERL2UIJN2ckt8Aovs/Zb9VTbJx3IX+lOwGm SPwiI22Arin2BcxLEmElXrQkTZ3/UHRfgC5iE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=f06zvCtNpwfTL+4Itq4rCpQRN53L0BPN7ECqHQNOVpQ=; b=hjGsvo8amJ/8aCs+bXAmap/a+B0wvQDQVsXvCrBVBbZehNzBv3m89vExR8PISqQK4t eJSOMtP0MQFM/hPT1+hJd8RWv9xWZ029hcSVLyxQOcjwZiK14QWnN41iEtWSSR7Hdknk pF47x2+SZyJdzy/ZZAZXZAHeIpmhTWvILXGlKnpeZWw76VYGbS0fD/O1c5cIF2tUYI6P kJKxoUobuo3XQFDmmDCq2xoQRPieu84N6bh/2bwBgI9UIcvzNk49g0GKfCwsui7NUrIh sYnfEESiNchgj2dy/zLljESpWRjzRowFsSPlJtpGuT8zT7ioL5F1Syb5Gsg3bWEJTQkg 2XYA== X-Gm-Message-State: AOAM533FMHU3r0WgFqNojBydLu1iTVS+XJJ7Uw93a8wiOyuXDcUPErTp H/vF7TSDywFX0mQCQUyyrRXn31W5sJcmbQ== X-Google-Smtp-Source: ABdhPJy0V3QPWe9OCC5BzhvripSCCY8Eu0kwoqfk1tcV7CeUAp40W1jCpVlnzM4bfsxD3dMnD6g4iQ== X-Received: by 2002:a19:675d:: with SMTP id e29mr7104490lfj.491.1608592412652; Mon, 21 Dec 2020 15:13:32 -0800 (PST) Received: from mail-lf1-f42.google.com (mail-lf1-f42.google.com. [209.85.167.42]) by smtp.gmail.com with ESMTPSA id s7sm2452011ljp.38.2020.12.21.15.13.30 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 21 Dec 2020 15:13:31 -0800 (PST) Received: by mail-lf1-f42.google.com with SMTP id o19so27699887lfo.1 for ; Mon, 21 Dec 2020 15:13:30 -0800 (PST) X-Received: by 2002:a2e:3211:: with SMTP id y17mr8114725ljy.61.1608592410631; Mon, 21 Dec 2020 15:13:30 -0800 (PST) MIME-Version: 1.0 References: <20201219043006.2206347-1-namit@vmware.com> <20201221172711.GE6640@xz-x1> <76B4F49B-ED61-47EA-9BE4-7F17A26B610D@gmail.com> <9E301C7C-882A-4E0F-8D6D-1170E792065A@gmail.com> <20201221215526.GK6640@xz-x1> In-Reply-To: <20201221215526.GK6640@xz-x1> From: Linus Torvalds Date: Mon, 21 Dec 2020 15:13:14 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH] mm/userfaultfd: fix memory corruption due to writeprotect To: Peter Xu Cc: Nadav Amit , Yu Zhao , Andrea Arcangeli , linux-mm , lkml , Pavel Emelyanov , Mike Kravetz , Mike Rapoport , stable , Minchan Kim , Andy Lutomirski , Will Deacon , Peter Zijlstra Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Dec 21, 2020 at 1:55 PM Peter Xu wrote: > > Frankly speaking I don't know why it's always safe to do data copy without the > pgtable lock in wp_page_copy(), since I don't know what guaranteed us from data > changing on the original page due to any reason. So the reason it should be safe is that (a) the pte is write-protected (b) we're clearly not a shared mapping, so that if anybody else writes to the page in another mapping, that's irrelevant (think of it as "page copy happened earlier") (c) before we install the copied page, we check that nothing changed our initial assumption in (a). And the problem is that userfaultfd basically can cause that (c) phase to fail. Linus