From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3803C25B08 for ; Tue, 9 Aug 2022 19:10:08 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0EFFD8E0002; Tue, 9 Aug 2022 15:10:08 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 09F928E0001; Tue, 9 Aug 2022 15:10:08 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E5AB68E0002; Tue, 9 Aug 2022 15:10:07 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id D34238E0001 for ; Tue, 9 Aug 2022 15:10:07 -0400 (EDT) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id C5C4F1610BE for ; Tue, 9 Aug 2022 19:10:06 +0000 (UTC) X-FDA: 79780994412.29.0316C4F Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf10.hostedemail.com (Postfix) with ESMTP id 1F222C016C for ; Tue, 9 Aug 2022 19:10:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660072205; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uRqc1okeAHdsmQUrvr7UCGZmXL46y0LkrGmGnuyVW2Y=; b=bNy5dgD+WjnKr2YpMcBW6X/LNgY+YseFbaQ1KY+mmQYyA8LZu2MC3tZB+UlSxHn2zleX3R kuqHZKt6biici5eM9hgJQqpRcUbcRmwPlUtbcYlzCGFGK2z1+6lJlVBvSy9Q+J+R72wuAY abrxbzBplTgkObyPJpDf7alZKEs4bRk= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-641-csahjRLbPK2Djcr-ej1qiQ-1; Tue, 09 Aug 2022 15:10:02 -0400 X-MC-Unique: csahjRLbPK2Djcr-ej1qiQ-1 Received: by mail-wm1-f69.google.com with SMTP id r10-20020a1c440a000000b003a538a648a9so3509132wma.5 for ; Tue, 09 Aug 2022 12:10:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:in-reply-to:subject:organization:from :references:cc:to:content-language:user-agent:mime-version:date :message-id:x-gm-message-state:from:to:cc; bh=uRqc1okeAHdsmQUrvr7UCGZmXL46y0LkrGmGnuyVW2Y=; b=iUJ28NXyYROluA1EzDbrgxlozyETVtDejn3arY3rbUqYeXukAnMKLgcPuidMJkBedW Y7ySpTMQMi/tywnFu1rl5n061z5KQ//869uUa3XZodc0P77oyTkbMiI6mqiJ3yCVKxDf TB27i+Ig+k/F+djqhbO+gkOQ2O7y/7M1Gpi9FDSgTaLHm1UBd5Z7UIixAD9QqaKQBIBJ cjCKjP8DAEn6b7GjRi+UJYpNtmRwtMCkQSEv2rTslQMKbz8ZojJUYm2Ta41XkRFJSkex zVtOSR3q5eH4GmASdpKTU2UTCB9/qcd8bKF3Geb6vpYY7HDKRoZAz1WE2VY++xCc9bBr tSDA== X-Gm-Message-State: ACgBeo3kTImosOFpRu2DsolREiiXidgOtiUR46t8CsaGCL3zkXQSjC5Q s/FTNgEmsvELpbDxNbfX/cyTEkELCWnEvhDKBoHt5T8ufz2gflamTCtoMPtMUdwOGNcUXMfjvyt RzRTrbCRaB0E= X-Received: by 2002:adf:e848:0:b0:220:7dc6:135f with SMTP id d8-20020adfe848000000b002207dc6135fmr15173022wrn.24.1660072201163; Tue, 09 Aug 2022 12:10:01 -0700 (PDT) X-Google-Smtp-Source: AA6agR5+SQNNtefTpJvPGn+VBLgI5xGu/AqwT3DTT0u2MzgOrtbJb/8gsc+bA2KK7SA4FWebAox2Vw== X-Received: by 2002:adf:e848:0:b0:220:7dc6:135f with SMTP id d8-20020adfe848000000b002207dc6135fmr15173003wrn.24.1660072200926; Tue, 09 Aug 2022 12:10:00 -0700 (PDT) Received: from ?IPV6:2003:cb:c705:3700:aed2:a0f8:c270:7f30? (p200300cbc7053700aed2a0f8c2707f30.dip0.t-ipconnect.de. [2003:cb:c705:3700:aed2:a0f8:c270:7f30]) by smtp.gmail.com with ESMTPSA id bd14-20020a05600c1f0e00b003a5542047afsm2762941wmb.19.2022.08.09.12.10.00 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 09 Aug 2022 12:10:00 -0700 (PDT) Message-ID: Date: Tue, 9 Aug 2022 21:09:59 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.11.0 To: Linus Torvalds Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Andrew Morton , Greg Kroah-Hartman , Axel Rasmussen , Peter Xu , Hugh Dickins , Andrea Arcangeli , Matthew Wilcox , Vlastimil Babka , John Hubbard , Jason Gunthorpe References: <20220808073232.8808-1-david@redhat.com> From: David Hildenbrand Organization: Red Hat Subject: Re: [PATCH v1] mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1660072206; a=rsa-sha256; cv=none; b=zb2W2XAtdXDbRcAtMeJ1fK95pLcF0u2q8XhS6naCRJNmyUGoKDdRLTJdTV5vrEhUBnAJtB PZuY8mgUHHXSfjp23An/gFJVpY5Wdqsp3C7GqDkFdPtM2gPhRbSW0OYHEJO6/S1JN2ZOM+ 65N2nJmCnyMtpI3EU6uyuB0/q3xDQ+4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1660072206; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uRqc1okeAHdsmQUrvr7UCGZmXL46y0LkrGmGnuyVW2Y=; b=BtGYtd59kPVkl5yAp1Vb1fotJ45bsmuZPfqAO6q87yjjQIeqSkyb92NSoqTG9eDzYE6uCK W7LEZgRf+tENOFaNrHZC2wOfnCqMXbaX6r/hx4pHXifLcez0j8nDhH8XZFhjVIuSYxeKtv Wd1UO7xOfhiTrb/soePR/cjY0RMR/Lk= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=bNy5dgD+; spf=pass (imf10.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com X-Stat-Signature: w761xyqyanag1qrrc1bzhafnh97xeda4 X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 1F222C016C Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=bNy5dgD+; spf=pass (imf10.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com X-HE-Tag: 1660072205-112972 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 09.08.22 20:48, Linus Torvalds wrote: > On Mon, Aug 8, 2022 at 12:32 AM David Hildenbrand wrote: >> >> For example, a write() via /proc/self/mem to a uffd-wp-protected range has >> to fail instead of silently granting write access and bypassing the >> userspace fault handler. > > This, btw, just makes me go "uffd-wp is broken garbage" once more. > > It also makes me go "if uffd-wp can disallow ptrace writes, then why > doesn't regular write protect do it"? I remember that it's not just uffd-wp, it's also ordinary userfaultfd if we have no page mapped, because we'd have to drop the mmap lock in order to notify user space about the fault and wait for a resolution. IIUC, we cannot tell what exactly user-space will do as a response to a user write fault here (for example, QEMU VM snapshots have to copy page content away such that the VM snapshot remains consistent and we won't corrupt the snapshot), so we have to back off and fail the GUP. I'd say, for ptrace that's even the right thing to do because one might deadlock waiting on the user space thread that handles faults ... but that's a little off-topic to this fix here. I'm just trying to keep the semantics unchanged, as weird as they might be. > > IOW, I don't think the patch is wrong (apart from the VM_BUG_ON's that > absolutely must go away), but I get the strong feelign that we instead > should try to get rid of FOLL_FORCE entirely. I can resend v2 soonish, taking care of the VM_BUG_ON as you requested if there are no other comments. > > If some other user action can stop FOLL_FORCE anyway, then why do we > support it at all? My humble opinion is that debugging userfaultfd-managed memory is a corner case and that we can hopefully stop using FOLL_FORCE outside of debugging context soon. Having that said, I do enjoy having the uffd and uffd-wp feature available in user space (especially in QEMU). I don't always enjoy having to handle such corner cases in the kernel. -- Thanks, David / dhildenb