linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH RFC 0/9] s390: fixes, cleanups and optimizations for page table walkers
@ 2021-09-09 14:59 David Hildenbrand
  2021-09-09 14:59 ` [PATCH RFC 1/9] s390/gmap: validate VMA in __gmap_zap() David Hildenbrand
                   ` (8 more replies)
  0 siblings, 9 replies; 17+ messages in thread
From: David Hildenbrand @ 2021-09-09 14:59 UTC (permalink / raw)
  To: linux-kernel
  Cc: linux-s390, kvm, linux-mm, David Hildenbrand,
	Christian Borntraeger, Janosch Frank, Cornelia Huck,
	Claudio Imbrenda, Heiko Carstens, Vasily Gorbik, Niklas Schnelle,
	Gerald Schaefer, Ulrich Weigand

RFC because the patches are essentially untested and I did not actually
try to trigger any of the things these patches are supposed to fix. It
merely matches my current understanding (and what other code does :) ). I
did compile-test as far as possible.

After learning more about the wonderful world of page tables and their
interaction with the mmap_sem and VMAs, I spotted some issues in our
page table walkers that allow user space to trigger nasty behavior when
playing dirty tricks with munmap() or mmap() of hugetlb. While some issues
should be hard to trigger, others are fairly easy because we provide
conventient interfaces (e.g., KVM_S390_GET_SKEYS and KVM_S390_SET_SKEYS).

Future work:
- Don't use get_locked_pte() when it's not required to actually allocate
  page tables -- similar to how storage keys are now handled. Examples are
  get_pgste() and __gmap_zap.
- Don't use get_locked_pte() and instead let page fault logic allocate page
  tables when we actually do need page tables -- also, similar to how
  storage keys are now handled. Examples are set_pgste_bits() and
  pgste_perform_essa().
- Maybe switch to mm/pagewalk.c to avoid custom page table walkers. For
  __gmap_zap() that's very easy.

Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Cornelia Huck <cohuck@redhat.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Niklas Schnelle <schnelle@linux.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Ulrich Weigand <Ulrich.Weigand@de.ibm.com>

David Hildenbrand (9):
  s390/gmap: validate VMA in __gmap_zap()
  s390/gmap: don't unconditionally call pte_unmap_unlock() in
    __gmap_zap()
  s390/mm: validate VMA in PGSTE manipulation functions
  s390/mm: fix VMA and page table handling code in storage key handling
    functions
  s390/uv: fully validate the VMA before calling follow_page()
  s390/pci_mmio: fully validate the VMA before calling follow_pte()
  s390/mm: no need for pte_alloc_map_lock() if we know the pmd is
    present
  s390/mm: optimize set_guest_storage_key()
  s390/mm: optimize reset_guest_reference_bit()

 arch/s390/kernel/uv.c    |   2 +-
 arch/s390/mm/gmap.c      |  11 +++-
 arch/s390/mm/pgtable.c   | 109 +++++++++++++++++++++++++++------------
 arch/s390/pci/pci_mmio.c |   4 +-
 4 files changed, 89 insertions(+), 37 deletions(-)


base-commit: 7d2a07b769330c34b4deabeed939325c77a7ec2f
-- 
2.31.1


^ permalink raw reply	[flat|nested] 17+ messages in thread

end of thread, other threads:[~2021-09-10 14:52 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-09 14:59 [PATCH RFC 0/9] s390: fixes, cleanups and optimizations for page table walkers David Hildenbrand
2021-09-09 14:59 ` [PATCH RFC 1/9] s390/gmap: validate VMA in __gmap_zap() David Hildenbrand
2021-09-09 14:59 ` [PATCH RFC 2/9] s390/gmap: don't unconditionally call pte_unmap_unlock() " David Hildenbrand
2021-09-09 14:59 ` [PATCH RFC 3/9] s390/mm: validate VMA in PGSTE manipulation functions David Hildenbrand
2021-09-09 14:59 ` [PATCH RFC 4/9] s390/mm: fix VMA and page table handling code in storage key handling functions David Hildenbrand
2021-09-09 14:59 ` [PATCH RFC 5/9] s390/uv: fully validate the VMA before calling follow_page() David Hildenbrand
2021-09-10 14:14   ` Liam Howlett
2021-09-09 14:59 ` [PATCH RFC 6/9] s390/pci_mmio: fully validate the VMA before calling follow_pte() David Hildenbrand
2021-09-10  8:22   ` Niklas Schnelle
2021-09-10  9:23     ` David Hildenbrand
2021-09-10 12:48       ` Niklas Schnelle
2021-09-10 14:12       ` Liam Howlett
2021-09-10 14:31         ` Niklas Schnelle
2021-09-10 14:52           ` Liam Howlett
2021-09-09 14:59 ` [PATCH RFC 7/9] s390/mm: no need for pte_alloc_map_lock() if we know the pmd is present David Hildenbrand
2021-09-09 14:59 ` [PATCH RFC 8/9] s390/mm: optimize set_guest_storage_key() David Hildenbrand
2021-09-09 14:59 ` [PATCH RFC 9/9] s390/mm: optimize reset_guest_reference_bit() David Hildenbrand

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).