From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BBC9C4361B for ; Sat, 19 Dec 2020 19:15:28 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9CAD423406 for ; Sat, 19 Dec 2020 19:15:27 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9CAD423406 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id C17E66B005C; Sat, 19 Dec 2020 14:15:26 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id BEF386B005D; Sat, 19 Dec 2020 14:15:26 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B05446B0068; Sat, 19 Dec 2020 14:15:26 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0172.hostedemail.com [216.40.44.172]) by kanga.kvack.org (Postfix) with ESMTP id 9A6E96B005C for ; Sat, 19 Dec 2020 14:15:26 -0500 (EST) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 5A3C5180AD815 for ; Sat, 19 Dec 2020 19:15:26 +0000 (UTC) X-FDA: 77610985452.05.quiet46_380a97627448 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin05.hostedemail.com (Postfix) with ESMTP id 425341802387F for ; Sat, 19 Dec 2020 19:15:26 +0000 (UTC) X-HE-Tag: quiet46_380a97627448 X-Filterd-Recvd-Size: 3621 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [63.128.21.124]) by imf07.hostedemail.com (Postfix) with ESMTP for ; Sat, 19 Dec 2020 19:15:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1608405325; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ywV9ag7r8Yesrq5smCjuibhNxqS7FDwB5/W0QCJT39A=; b=f1dic8Pb8Fu/hEX9eXaq6tBfrw54swZJytnik2XJ+VJ5SIgVFH8WqcTKi9OgMsCWmR8yAz BfOBmHWQvCrcNoRnnRAdwqxuMryrK5tV8f8KVL5uNjjNkuOcDMAIxxFzJKfYKgw8E31O6g ZBuNfaOO9uggKuj7qwQTtpRo2mW1K/o= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-446-sVl4iiBhPNWNgqgvFyffmg-1; Sat, 19 Dec 2020 14:15:23 -0500 X-MC-Unique: sVl4iiBhPNWNgqgvFyffmg-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id C4F1F10054FF; Sat, 19 Dec 2020 19:15:21 +0000 (UTC) Received: from mail (ovpn-119-164.rdu2.redhat.com [10.10.119.164]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 20FBD1002382; Sat, 19 Dec 2020 19:15:18 +0000 (UTC) Date: Sat, 19 Dec 2020 14:15:17 -0500 From: Andrea Arcangeli To: Nadav Amit Cc: linux-mm@kvack.org, Peter Xu , linux-kernel@vger.kernel.org, Nadav Amit , Pavel Emelyanov , Mike Kravetz , Mike Rapoport , stable@vger.kernel.org Subject: Re: [PATCH] mm/userfaultfd: fix memory corruption due to writeprotect Message-ID: References: <20201219043006.2206347-1-namit@vmware.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20201219043006.2206347-1-namit@vmware.com> User-Agent: Mutt/2.0.3 (2020-12-04) X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hello, On Fri, Dec 18, 2020 at 08:30:06PM -0800, Nadav Amit wrote: > Analyzing this problem indicates that there is a real bug since > mmap_lock is only taken for read in mwriteprotect_range(). This might Never having to take the mmap_sem for writing, and in turn never blocking, in order to modify the pagetables is quite an important feature in uffd that justifies uffd instead of mprotect. It's not the most important reason to use uffd, but it'd be nice if that guarantee would remain also for the UFFDIO_WRITEPROTECT API, not only for the other pgtable manipulations. > Consider the following scenario with 3 CPUs (cpu2 is not shown): > > cpu0 cpu1 > ---- ---- > userfaultfd_writeprotect() > [ write-protecting ] > mwriteprotect_range() > mmap_read_lock() > change_protection() > change_protection_range() > ... > change_pte_range() > [ defer TLB flushes] > userfaultfd_writeprotect() > mmap_read_lock() > change_protection() > [ write-unprotect ] > ... > [ unprotect PTE logically ] > ... > [ page-fault] > ... > wp_page_copy() > [ set new writable page in PTE] Can't we check mm_tlb_flush_pending(vma->vm_mm) if MM_CP_UFFD_WP_ALL is set and do an explicit (potentially spurious) tlb flush before write-unprotect? Thanks, Andrea