From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 308BCC4361B for ; Sun, 20 Dec 2020 02:01:55 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A34A323A9B for ; Sun, 20 Dec 2020 02:01:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A34A323A9B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 251816B005C; Sat, 19 Dec 2020 21:01:54 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 203E16B005D; Sat, 19 Dec 2020 21:01:54 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0F3A86B0068; Sat, 19 Dec 2020 21:01:54 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0027.hostedemail.com [216.40.44.27]) by kanga.kvack.org (Postfix) with ESMTP id E8C466B005C for ; Sat, 19 Dec 2020 21:01:53 -0500 (EST) Received: from smtpin29.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id AE990180AD837 for ; Sun, 20 Dec 2020 02:01:53 +0000 (UTC) X-FDA: 77612009706.29.space00_3806c692744a Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin29.hostedemail.com (Postfix) with ESMTP id 91C0718025BEE for ; Sun, 20 Dec 2020 02:01:53 +0000 (UTC) X-HE-Tag: space00_3806c692744a X-Filterd-Recvd-Size: 6376 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf12.hostedemail.com (Postfix) with ESMTP for ; Sun, 20 Dec 2020 02:01:52 +0000 (UTC) X-Gm-Message-State: AOAM533IAypYW8KTqSMDcAUBAQ3CO9ScsrqTeptz8RsMYK1Mp1P0k9yk BseHH0YB0SiP3nzdYQ7VSVbabwz019s5AJYtidi8dg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1608429712; bh=SnpmJA7RQYbU8RQ1XC54nkNwo0zSWeRz3Ts91x0CAyc=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=Nms3CFFBJJJy0s56usyXXOLaHkRo+WDd7vpHZqCp3Cme881lJ1swcOmCkLiRvEoMx vybkG3PhWN09A/Xlzt8Er8Zq94wts93DYz1kadJY6/pIn//yURv1UQ/ws1w1xemk1Q 4uyiz/t6dSOKZx97OZ3gKmETRNMvnJpCsu8FXGyyd0pIDiOAVKkGy2HhDQCZ/gX2KW Rx1EOrZdDSEloB1glSu7mfDlpo1coYvvzuXrKpjfaZZXQyRZfClVy7lBHM+L5ByfvJ tT5i+z/tDsNFn8WWiWS8u/miUdoIg6EqADkwWM2mL8eF7lwSVtQdg460qQh0GARtsj LnaHAFUEZlHmQ== X-Google-Smtp-Source: ABdhPJzxkWdxDEIeterCyrf+stzY/SxYI2/cfKC96RyQnm/M7F1J5UlK0mql+LLdDoZep39P+HqZkPXviX7k/HBMW5w= X-Received: by 2002:a1c:1d85:: with SMTP id d127mr10455072wmd.49.1608429710342; Sat, 19 Dec 2020 18:01:50 -0800 (PST) MIME-Version: 1.0 References: <20201219043006.2206347-1-namit@vmware.com> In-Reply-To: From: Andy Lutomirski Date: Sat, 19 Dec 2020 18:01:39 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH] mm/userfaultfd: fix memory corruption due to writeprotect To: Nadav Amit , Dave Hansen Cc: Andrea Arcangeli , linux-mm , Peter Xu , lkml , Pavel Emelyanov , Mike Kravetz , Mike Rapoport , stable , Minchan Kim , Andy Lutomirski , Yu Zhao , Will Deacon , Peter Zijlstra Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, Dec 19, 2020 at 1:34 PM Nadav Amit wrote: > > [ cc=E2=80=99ing some more people who have experience with similar proble= ms ] > > > On Dec 19, 2020, at 11:15 AM, Andrea Arcangeli wr= ote: > > > > Hello, > > > > On Fri, Dec 18, 2020 at 08:30:06PM -0800, Nadav Amit wrote: > >> Analyzing this problem indicates that there is a real bug since > >> mmap_lock is only taken for read in mwriteprotect_range(). This might > > > > Never having to take the mmap_sem for writing, and in turn never > > blocking, in order to modify the pagetables is quite an important > > feature in uffd that justifies uffd instead of mprotect. It's not the > > most important reason to use uffd, but it'd be nice if that guarantee > > would remain also for the UFFDIO_WRITEPROTECT API, not only for the > > other pgtable manipulations. > > > >> Consider the following scenario with 3 CPUs (cpu2 is not shown): > >> > >> cpu0 cpu1 > >> ---- ---- > >> userfaultfd_writeprotect() > >> [ write-protecting ] > >> mwriteprotect_range() > >> mmap_read_lock() > >> change_protection() > >> change_protection_range() > >> ... > >> change_pte_range() > >> [ defer TLB flushes] > >> userfaultfd_writeprotect() > >> mmap_read_lock() > >> change_protection() > >> [ write-unprotect ] > >> ... > >> [ unprotect PTE logically ] > >> ... > >> [ page-fault] > >> ... > >> wp_page_copy() > >> [ set new writable page in PTE] > > > > Can't we check mm_tlb_flush_pending(vma->vm_mm) if MM_CP_UFFD_WP_ALL > > is set and do an explicit (potentially spurious) tlb flush before > > write-unprotect? > > There is a concrete scenario that I actually encountered and then there i= s a > general problem. > > In general, the kernel code assumes that PTEs that are read from the > page-tables are coherent across all the TLBs, excluding permission promot= ion > (i.e., the PTE may have higher permissions in the page-tables than those > that are cached in the TLBs). > > We therefore need to both: (a) protect change_protection_range() from the > changes of others who might defer TLB flushes without taking mmap_sem for > write (e.g., try_to_unmap_one()); and (b) to protect others (e.g., > page-fault handlers) from concurrent changes of change_protection(). > > We have already encountered several similar bugs, and debugging such issu= es > s time consuming and these bugs impact is substantial (memory corruption, > security). So I think we should only stick to general solutions. > > So perhaps your the approach of your proposed solution is feasible, but i= t > would have to be applied all over the place: we will need to add a check = for > mm_tlb_flush_pending() and conditionally flush the TLB in every case in > which PTEs are read and there might be an assumption that the > access-permission reflect what the TLBs hold. This includes page-fault > handlers, but also NUMA migration code in change_protection(), softdirty > cleanup in clear_refs_write() and maybe others. I missed the beginning of this thread, but it looks to me like userfaultfd changes PTEs with not locking except mmap_read_lock(). It also calls inc_tlb_flush_pending(), which is very explicitly documented as requiring the pagetable lock. Those docs must be wrong, because mprotect() uses the mmap_sem write lock, which is just fine, but ISTM some kind of mutual exclusion with proper acquire/release ordering is indeed needed. So the userfaultfd code seems bogus. I think userfaultfd either needs to take a real lock (probably doesn't matter which) or the core rules about PTEs need to be rewritten.