From: Peter Xu <peterx@redhat.com>
To: Jason Gunthorpe <jgg@ziepe.ca>
Cc: "John Hubbard" <jhubbard@nvidia.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
"Andrew Morton" <akpm@linux-foundation.org>,
"Andrea Arcangeli" <aarcange@redhat.com>,
"Jan Kara" <jack@suse.cz>, "Jérôme Glisse" <jglisse@redhat.com>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
"Alex Williamson" <alex.williamson@redhat.com>
Subject: Re: [PATCH] mm: Fix invalid page pointer returned with FOLL_PIN gups
Date: Fri, 28 Jan 2022 09:36:14 +0800 [thread overview]
Message-ID: <YfNIjqPpty0YkLJP@xz-m1.local> (raw)
In-Reply-To: <20220127152538.GQ8034@ziepe.ca>
On Thu, Jan 27, 2022 at 11:25:38AM -0400, Jason Gunthorpe wrote:
> On Thu, Jan 27, 2022 at 05:19:56PM +0800, Peter Xu wrote:
>
> > > > > diff --git a/mm/gup.c b/mm/gup.c
> > > > > index f0af462ac1e2..8ebc04058e97 100644
> > > > > +++ b/mm/gup.c
> > > > > @@ -440,7 +440,7 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
> > > > > pte_t *pte, unsigned int flags)
> > > > > {
> > > > > /* No page to get reference */
> > > > > - if (flags & FOLL_GET)
> > > > > + if (flags & (FOLL_GET | FOLL_PIN))
> > > > > return -EFAULT;
> > > >
> > > > Yes. This clearly fixes the problem that the patch describes, and also
> > > > clearly matches up with the Fixes tag. So that's correct.
> > >
> > > It is a really confusing though, why not just always return -EEXIST
> > > here?
> >
> > Because in current code GUP handles -EEXIST and -EFAULT differently?
>
> That has nothing to do with here. We shouldn't be deciding what the
> top layer does way down here. Return the correct error code for what
> was discovered at this layer the upper loop should make the decision
> what it should do
>
> > We do early bail out on -EFAULT. -EEXIST was first introduced in 2015 from
> > Kirill for not failing some mlock() or mmap(MAP_POPULATE) on dax (1027e4436b6).
> > Then in 2017 it got used again with pud-sized thp (a00cc7d9dd93d) on dax too.
> > They seem to service the same goal and it seems to be designed that -EEXIST
> > shouldn't fail GUP immediately.
>
> It must fail GUP immeidately if there is a pages list.
Right, but my point is we don't have an user at all for follow_page_mask()
returning -EEXIST with a **page which is non-NULL. Or did I miss it?
>
> Callers that want an early failure must pass in NULL for pages, it is
> just that simple. It has nothing to do with the FOLL flags.
>
> A WARN_ON would be appropriate to compare the FOLL flags against the
> pages. eg FOLL_GET without a pages is nonsense and should be
> immediately aborted. On the other hand, we avoid this by construction
> internal to gup.c
We have something like that already, although it's only a VM_BUG_ON() not a
BUG_ON() or WARN_ON() at the entry of __get_user_pages():
VM_BUG_ON(!!pages != !!(gup_flags & (FOLL_GET | FOLL_PIN)));
>
> > > > Here, however, I think we need to consider this a little more carefully,
> > > > and attempt to actually fix up this case. It is never going to be OK
> > > > here, to return a **pages array that has these little landmines of
> > > > potentially uninitialized pointers. And so continuing on *at all* seems
> > > > very wrong.
> > >
> > > Indeed, it should just be like this:
> > >
> > > @@ -1182,6 +1182,10 @@ static long __get_user_pages(struct mm_struct *mm,
> > > * Proper page table entry exists, but no corresponding
> > > * struct page.
> > > */
> > > + if (pages) {
> > > + page = ERR_PTR(-EFAULT);
> > > + goto out;
> > > + }
> > > goto next_page;
> > > } else if (IS_ERR(page)) {
> > > ret = PTR_ERR(page);
> >
> > IIUC not failing -EEXIST immediately seems to be what we want.
>
> Which is what this does, for the only case it is acceptable - a null
> page list.
>
> > From that POV, WARN_ON_ONCE() helps better on exposing an illegal return of
> > -EEXIST (as mentioned in the commit message) than the -EFAULT convertion, IMHO.
>
> Again, that is upside down, -EEXIST should not be a illegal return. It
> should be valid, have a defined meaning 'the vaddr exists but has no
> struct page' and the top loop, and only the top loop, makes the
> decision what to do about it.
I believe this works too and I think I get your point, but as stated above it's
just not used yet so the path is not useful to any real code path.
Especially with above VM_BUG_ON() it means if we'll go into the "if (pages)" we
should have already triggered the VM_BUG_ON() condition when entering the function.
Thanks,
--
Peter Xu
next prev parent reply other threads:[~2022-01-28 1:36 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-25 3:37 [PATCH] mm: Fix invalid page pointer returned with FOLL_PIN gups Peter Xu
2022-01-27 0:15 ` John Hubbard
2022-01-27 0:42 ` Jason Gunthorpe
2022-01-27 9:19 ` Peter Xu
2022-01-27 15:25 ` Jason Gunthorpe
2022-01-28 1:36 ` Peter Xu [this message]
2022-01-28 2:31 ` Jason Gunthorpe
2022-01-28 3:26 ` Peter Xu
2022-01-28 5:57 ` John Hubbard
2022-01-28 6:15 ` Peter Xu
2022-01-28 14:12 ` Jason Gunthorpe
2022-01-28 2:32 ` John Hubbard
2022-01-28 3:30 ` Peter Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YfNIjqPpty0YkLJP@xz-m1.local \
--to=peterx@redhat.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=alex.williamson@redhat.com \
--cc=jack@suse.cz \
--cc=jgg@ziepe.ca \
--cc=jglisse@redhat.com \
--cc=jhubbard@nvidia.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).