From: Mike Rapoport <rppt@linux.vnet.ibm.com>
To: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
Hillf Danton <hillf.zj@alibaba-inc.com>,
Mike Kravetz <mike.kravetz@oracle.com>,
Pavel Emelyanov <xemul@virtuozzo.com>,
Linux-MM <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2 4/5] userfaultfd: mcopy_atomic: return -ENOENT when no compatible VMA found
Date: Fri, 3 Feb 2017 18:52:57 +0200 [thread overview]
Message-ID: <20170203165256.GB3183@rapoport-lnx> (raw)
In-Reply-To: <20170202180247.GA32446@redhat.com>
Hello Andrea,
On Thu, Feb 02, 2017 at 07:02:47PM +0100, Andrea Arcangeli wrote:
> On Fri, Jan 27, 2017 at 08:44:32PM +0200, Mike Rapoport wrote:
> > - err = -EINVAL;
> > + err = -ENOENT;
> > dst_vma = find_vma(dst_mm, dst_start);
> > if (!dst_vma || !is_vm_hugetlb_page(dst_vma))
> > goto out_unlock;
> > + /*
> > + * Only allow __mcopy_atomic_hugetlb on userfaultfd
> > + * registered ranges.
> > + */
> > + if (!dst_vma->vm_userfaultfd_ctx.ctx)
> > + goto out_unlock;
> >
> > + err = -EINVAL;
> > if (vma_hpagesize != vma_kernel_pagesize(dst_vma))
> > goto out_unlock;
>
> That's correct, if a new vma emerges with a different page size it
> cannot have a not null dst_vma->vm_userfaultfd_ctx.ctx in the non
> cooperative case.
>
> > @@ -219,12 +226,6 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
> > goto out_unlock;
> >
> > /*
> > - * Only allow __mcopy_atomic_hugetlb on userfaultfd registered ranges.
> > - */
> > - if (!dst_vma->vm_userfaultfd_ctx.ctx)
> > - goto out_unlock;
> > -
> > - /*
>
> but this is buggy and it shouldn't be removed, we need this check also
> if dst_vma was found not NULL.
The check for not-NULL uffd context is done in __mcopy_atomic, between
find_vma and call to __mcopy_atomic_hugetlb. Sp, at this point we verified
that dst_vma->vm_userfaultfd_ctx.ctx is not NULL either in the caller, or
for the 'retry' case in the hunk above.
> > * Ensure the dst_vma has a anon_vma.
> > */
> > err = -ENOMEM;
> > @@ -368,10 +369,23 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm,
> > * Make sure the vma is not shared, that the dst range is
> > * both valid and fully within a single existing vma.
> > */
> > - err = -EINVAL;
> > + err = -ENOENT;
> > dst_vma = find_vma(dst_mm, dst_start);
> > if (!dst_vma)
> > goto out_unlock;
> > + /*
> > + * Be strict and only allow __mcopy_atomic on userfaultfd
> > + * registered ranges to prevent userland errors going
> > + * unnoticed. As far as the VM consistency is concerned, it
> > + * would be perfectly safe to remove this check, but there's
> > + * no useful usage for __mcopy_atomic ouside of userfaultfd
> > + * registered ranges. This is after all why these are ioctls
> > + * belonging to the userfaultfd and not syscalls.
> > + */
> > + if (!dst_vma->vm_userfaultfd_ctx.ctx)
> > + goto out_unlock;
> > +
> > + err = -EINVAL;
> > if (!vma_is_shmem(dst_vma) && dst_vma->vm_flags & VM_SHARED)
> > goto out_unlock;
> > if (dst_start < dst_vma->vm_start ||
>
> This isn't enough, the -ENOENT should be returned also if the address
> doesn't isn't in the range of the found vma, instead of -EINVAL. "vma"
> may be a completely different vma just it happen to be way above the
> fault address, and the vma previously covering the "addr" (which was
> below the found "vma") was already munmapped, so you'd be returning
> -EINVAL after munmap still unless the -EINVAL is moved down below.
Will fix, thanks.
> The check on !vma_is_shmem(dst_vma) && dst_vma->vm_flags & VM_SHARED
> instead can be shifted down below after setting err to -EINVAL as then
> we know the vma is really the one we were looking for but it's of a
> type we can't handle.
--
Sincerely yours,
Mike.
next prev parent reply other threads:[~2017-02-03 16:53 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-27 18:44 [PATCH v2 0/5] userfaultfd: non-cooperative: better tracking for mapping changes Mike Rapoport
2017-01-27 18:44 ` [PATCH v2 1/5] mm: call vm_munmap in munmap syscall instead of using open coded version Mike Rapoport
2017-01-27 18:44 ` [PATCH v2 2/5] userfaultfd: non-cooperative: add event for memory unmaps Mike Rapoport
2017-02-01 0:39 ` Andrew Morton
2017-02-01 6:37 ` Mike Rapoport
2017-02-02 9:15 ` Michal Hocko
2017-02-05 18:46 ` [v2,2/5] " Guenter Roeck
2017-02-06 23:52 ` Andrew Morton
2017-01-27 18:44 ` [PATCH v2 3/5] userfaultfd: non-cooperative: add event for exit() notification Mike Rapoport
2017-02-01 0:41 ` Andrew Morton
2017-02-01 6:35 ` Mike Rapoport
2017-02-01 22:27 ` Andrew Morton
2017-02-02 13:54 ` Mike Rapoport
2017-01-27 18:44 ` [PATCH v2 4/5] userfaultfd: mcopy_atomic: return -ENOENT when no compatible VMA found Mike Rapoport
2017-02-02 18:02 ` Andrea Arcangeli
2017-02-03 16:52 ` Mike Rapoport [this message]
2017-01-27 18:44 ` [PATCH v2 5/5] userfaultfd_copy: return -ENOSPC in case mm has gone Mike Rapoport
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170203165256.GB3183@rapoport-lnx \
--to=rppt@linux.vnet.ibm.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=dgilbert@redhat.com \
--cc=hillf.zj@alibaba-inc.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mike.kravetz@oracle.com \
--cc=xemul@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).