From: Jan Kara <jack@suse.cz>
To: John Hubbard <jhubbard@nvidia.com>
Cc: "Andrew Morton" <akpm@linux-foundation.org>,
"Al Viro" <viro@zeniv.linux.org.uk>,
"Alex Williamson" <alex.williamson@redhat.com>,
"Benjamin Herrenschmidt" <benh@kernel.crashing.org>,
"Björn Töpel" <bjorn.topel@intel.com>,
"Christoph Hellwig" <hch@infradead.org>,
"Dan Williams" <dan.j.williams@intel.com>,
"Daniel Vetter" <daniel@ffwll.ch>,
"Dave Chinner" <david@fromorbit.com>,
"David Airlie" <airlied@linux.ie>,
"David S . Miller" <davem@davemloft.net>,
"Ira Weiny" <ira.weiny@intel.com>, "Jan Kara" <jack@suse.cz>,
"Jason Gunthorpe" <jgg@ziepe.ca>, "Jens Axboe" <axboe@kernel.dk>,
"Jonathan Corbet" <corbet@lwn.net>,
"Jérôme Glisse" <jglisse@redhat.com>,
"Magnus Karlsson" <magnus.karlsson@intel.com>,
"Mauro Carvalho Chehab" <mchehab@kernel.org>,
"Michael Ellerman" <mpe@ellerman.id.au>,
"Michal Hocko" <mhocko@suse.com>,
"Mike Kravetz" <mike.kravetz@oracle.com>,
"Paul Mackerras" <paulus@samba.org>,
"Shuah Khan" <shuah@kernel.org>,
"Vlastimil Babka" <vbabka@suse.cz>,
bpf@vger.kernel.org, dri-devel@lists.freedesktop.org,
kvm@vger.kernel.org, linux-block@vger.kernel.org,
linux-doc@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-kselftest@vger.kernel.org, linux-media@vger.kernel.org,
linux-rdma@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
netdev@vger.kernel.org, linux-mm@kvack.org,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v8 24/26] mm/gup: track FOLL_PIN pages
Date: Tue, 10 Dec 2019 14:39:32 +0100 [thread overview]
Message-ID: <20191210133932.GH1551@quack2.suse.cz> (raw)
In-Reply-To: <20191209225344.99740-25-jhubbard@nvidia.com>
On Mon 09-12-19 14:53:42, John Hubbard wrote:
> Add tracking of pages that were pinned via FOLL_PIN.
>
> As mentioned in the FOLL_PIN documentation, callers who effectively set
> FOLL_PIN are required to ultimately free such pages via unpin_user_page().
> The effect is similar to FOLL_GET, and may be thought of as "FOLL_GET
> for DIO and/or RDMA use".
>
> Pages that have been pinned via FOLL_PIN are identifiable via a
> new function call:
>
> bool page_dma_pinned(struct page *page);
>
> What to do in response to encountering such a page, is left to later
> patchsets. There is discussion about this in [1], [2], and [3].
>
> This also changes a BUG_ON(), to a WARN_ON(), in follow_page_mask().
>
> [1] Some slow progress on get_user_pages() (Apr 2, 2019):
> https://lwn.net/Articles/784574/
> [2] DMA and get_user_pages() (LPC: Dec 12, 2018):
> https://lwn.net/Articles/774411/
> [3] The trouble with get_user_pages() (Apr 30, 2018):
> https://lwn.net/Articles/753027/
>
> Suggested-by: Jan Kara <jack@suse.cz>
> Suggested-by: Jérôme Glisse <jglisse@redhat.com>
> Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Looks nice, some comments below...
> +/*
> + * try_grab_compound_head() - attempt to elevate a page's refcount, by a
> + * flags-dependent amount.
> + *
> + * This has a default assumption of "use FOLL_GET behavior, if FOLL_PIN is not
> + * set".
> + *
> + * "grab" names in this file mean, "look at flags to decide with to use FOLL_PIN
> + * or FOLL_GET behavior, when incrementing the page's refcount.
> + */
> +static struct page *try_grab_compound_head(struct page *page, int refs,
> + unsigned int flags)
> +{
> + if (flags & FOLL_PIN)
> + return try_pin_compound_head(page, refs);
> +
> + return try_get_compound_head(page, refs);
> +}
> +
> +/**
> + * grab_page() - elevate a page's refcount by a flag-dependent amount
> + *
> + * This might not do anything at all, depending on the flags argument.
> + *
> + * "grab" names in this file mean, "look at flags to decide with to use FOLL_PIN
^^^ whether
> + * or FOLL_GET behavior, when incrementing the page's refcount.
> + *
> + * @page: pointer to page to be grabbed
> + * @flags: gup flags: these are the FOLL_* flag values.
> + *
> + * Either FOLL_PIN or FOLL_GET (or neither) may be set, but not both at the same
> + * time. (That's true throughout the get_user_pages*() and pin_user_pages*()
> + * APIs.) Cases:
> + *
> + * FOLL_GET: page's refcount will be incremented by 1.
> + * FOLL_PIN: page's refcount will be incremented by GUP_PIN_COUNTING_BIAS.
> + */
> +void grab_page(struct page *page, unsigned int flags)
> +{
> + if (flags & FOLL_GET)
> + get_page(page);
> + else if (flags & FOLL_PIN) {
> + get_page(page);
> + WARN_ON_ONCE(flags & FOLL_GET);
> + /*
> + * Use get_page(), above, to do the refcount error
> + * checking. Then just add in the remaining references:
> + */
> + page_ref_add(page, GUP_PIN_COUNTING_BIAS - 1);
This is wrong for two reasons:
1) You miss compound_head() indirection from get_page() for this
page_ref_add().
2) page_ref_add() could overflow the counter without noticing.
Especially with GUP_PIN_COUNTING_BIAS being non-trivial, it is realistic
that an attacker might try to overflow the page refcount and we have to
protect the kernel against that. So I think that all the places that would
use grab_page() actually need to use try_grab_page() and then gracefully
deal with the failure.
> @@ -278,11 +425,23 @@ static struct page *follow_page_pte(struct vm_area_struct *vma,
> goto retry;
> }
>
> - if (flags & FOLL_GET) {
> + if (flags & (FOLL_PIN | FOLL_GET)) {
> + /*
> + * Allow try_get_page() to take care of error handling, for
> + * both cases: FOLL_GET or FOLL_PIN:
> + */
> if (unlikely(!try_get_page(page))) {
> page = ERR_PTR(-ENOMEM);
> goto out;
> }
> +
> + if (flags & FOLL_PIN) {
> + WARN_ON_ONCE(flags & FOLL_GET);
> +
> + /* We got a +1 refcount from try_get_page(), above. */
> + page_ref_add(page, GUP_PIN_COUNTING_BIAS - 1);
> + __update_proc_vmstat(page, NR_FOLL_PIN_REQUESTED, 1);
> + }
> }
The same problem here as above, plus this place should use the same
try_grab..() helper, shouldn't it?
> @@ -544,8 +703,8 @@ static struct page *follow_page_mask(struct vm_area_struct *vma,
> /* make this handle hugepd */
> page = follow_huge_addr(mm, address, flags & FOLL_WRITE);
> if (!IS_ERR(page)) {
> - BUG_ON(flags & FOLL_GET);
> - return page;
> + WARN_ON_ONCE(flags & (FOLL_GET | FOLL_PIN));
> + return NULL;
I agree with the change to WARN_ON_ONCE but why is correct the change of
the return value? Note that this is actually a "success branch".
Honza
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
next prev parent reply other threads:[~2019-12-10 13:39 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-09 22:53 [PATCH v8 00/26] mm/gup: track dma-pinned pages: FOLL_PIN John Hubbard
2019-12-09 22:53 ` [PATCH v8 01/26] mm/gup: factor out duplicate code from four routines John Hubbard
2019-12-09 22:53 ` [PATCH v8 02/26] mm/gup: move try_get_compound_head() to top, fix minor issues John Hubbard
2019-12-09 22:53 ` [PATCH v8 03/26] mm: Cleanup __put_devmap_managed_page() vs ->page_free() John Hubbard
2019-12-09 22:53 ` [PATCH v8 04/26] mm: devmap: refactor 1-based refcounting for ZONE_DEVICE pages John Hubbard
2019-12-09 22:53 ` [PATCH v8 05/26] goldish_pipe: rename local pin_user_pages() routine John Hubbard
2019-12-09 22:53 ` [PATCH v8 06/26] mm: fix get_user_pages_remote()'s handling of FOLL_LONGTERM John Hubbard
2019-12-09 22:53 ` [PATCH v8 07/26] vfio: fix FOLL_LONGTERM use, simplify get_user_pages_remote() call John Hubbard
2019-12-09 22:53 ` [PATCH v8 08/26] mm/gup: allow FOLL_FORCE for get_user_pages_fast() John Hubbard
2019-12-10 10:28 ` Jan Kara
2019-12-09 22:53 ` [PATCH v8 09/26] IB/umem: use get_user_pages_fast() to pin DMA pages John Hubbard
2019-12-09 22:53 ` [PATCH v8 10/26] mm/gup: introduce pin_user_pages*() and FOLL_PIN John Hubbard
2019-12-09 22:53 ` [PATCH v8 11/26] goldish_pipe: convert to pin_user_pages() and put_user_page() John Hubbard
2019-12-09 22:53 ` [PATCH v8 12/26] IB/{core,hw,umem}: set FOLL_PIN via pin_user_pages*(), fix up ODP John Hubbard
2019-12-09 22:53 ` [PATCH v8 13/26] mm/process_vm_access: set FOLL_PIN via pin_user_pages_remote() John Hubbard
2019-12-09 22:53 ` [PATCH v8 14/26] drm/via: set FOLL_PIN via pin_user_pages_fast() John Hubbard
2019-12-09 22:53 ` [PATCH v8 15/26] fs/io_uring: set FOLL_PIN via pin_user_pages() John Hubbard
2019-12-09 22:53 ` [PATCH v8 16/26] net/xdp: " John Hubbard
2019-12-09 22:53 ` [PATCH v8 17/26] media/v4l2-core: set pages dirty upon releasing DMA buffers John Hubbard
2019-12-10 0:56 ` Andrew Morton
2019-12-10 5:48 ` John Hubbard
2019-12-10 10:17 ` Jan Kara
2019-12-09 22:53 ` [PATCH v8 18/26] media/v4l2-core: pin_user_pages (FOLL_PIN) and put_user_page() conversion John Hubbard
2019-12-09 22:53 ` [PATCH v8 19/26] vfio, mm: " John Hubbard
2019-12-09 22:53 ` [PATCH v8 20/26] powerpc: book3s64: convert to pin_user_pages() and put_user_page() John Hubbard
2019-12-09 23:46 ` John Hubbard
2019-12-10 5:53 ` John Hubbard
2019-12-11 0:49 ` Andrew Morton
2019-12-09 22:53 ` [PATCH v8 21/26] mm/gup_benchmark: use proper FOLL_WRITE flags instead of hard-coding "1" John Hubbard
2019-12-09 22:53 ` [PATCH v8 22/26] mm, tree-wide: rename put_user_page*() to unpin_user_page*() John Hubbard
2019-12-09 22:53 ` [PATCH v8 23/26] mm/gup: pass flags arg to __gup_device_* functions John Hubbard
2019-12-10 12:49 ` Jan Kara
2019-12-11 0:27 ` John Hubbard
2019-12-09 22:53 ` [PATCH v8 24/26] mm/gup: track FOLL_PIN pages John Hubbard
2019-12-10 13:39 ` Jan Kara [this message]
2019-12-11 0:27 ` John Hubbard
2019-12-09 22:53 ` [PATCH v8 25/26] mm/gup_benchmark: support pin_user_pages() and related calls John Hubbard
2019-12-09 22:53 ` [PATCH v8 26/26] selftests/vm: run_vmtests: invoke gup_benchmark with basic FOLL_PIN coverage John Hubbard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191210133932.GH1551@quack2.suse.cz \
--to=jack@suse.cz \
--cc=airlied@linux.ie \
--cc=akpm@linux-foundation.org \
--cc=alex.williamson@redhat.com \
--cc=axboe@kernel.dk \
--cc=benh@kernel.crashing.org \
--cc=bjorn.topel@intel.com \
--cc=bpf@vger.kernel.org \
--cc=corbet@lwn.net \
--cc=dan.j.williams@intel.com \
--cc=daniel@ffwll.ch \
--cc=davem@davemloft.net \
--cc=david@fromorbit.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=hch@infradead.org \
--cc=ira.weiny@intel.com \
--cc=jgg@ziepe.ca \
--cc=jglisse@redhat.com \
--cc=jhubbard@nvidia.com \
--cc=kvm@vger.kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=magnus.karlsson@intel.com \
--cc=mchehab@kernel.org \
--cc=mhocko@suse.com \
--cc=mike.kravetz@oracle.com \
--cc=mpe@ellerman.id.au \
--cc=netdev@vger.kernel.org \
--cc=paulus@samba.org \
--cc=shuah@kernel.org \
--cc=vbabka@suse.cz \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).