From: Linus Torvalds <torvalds@linux-foundation.org>
To: Michael Ellerman <mpe@ellerman.id.au>
Cc: Christoph Hellwig <hch@infradead.org>,
Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
linuxppc-dev@lists.ozlabs.org,
Martin Schwidefsky <schwidefsky@de.ibm.com>,
linux-s390 <linux-s390@vger.kernel.org>,
Nicholas Piggin <npiggin@gmail.com>,
"Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>,
Paul Mackerras <paulus@ozlabs.org>
Subject: Re: Linux 5.1-rc5
Date: Tue, 16 Apr 2019 21:13:17 -0700 [thread overview]
Message-ID: <CAHk-=wi2HxyJoH3xhr_ytM3gf1mkvq8Dq9Do+EdNZrm8KjV_6w@mail.gmail.com> (raw)
In-Reply-To: <87sguhti6e.fsf@concordia.ellerman.id.au>
On Tue, Apr 16, 2019 at 8:38 PM Michael Ellerman <mpe@ellerman.id.au> wrote:
>
> > That said, powerpc and s390 should at least look at maybe adding a
> > check for the page ref in their gup paths too. Powerpc has the special
> > gup_hugepte() case
>
> Which uses page_cache_add_speculative(), which handles the case of the
> refcount being zero but not overflow. So that looks like it needs
> fixing.
Note that unlike the zero check, the "too many refs" check does _not_
need to be atomic.
Because it's not a correctness issue right at some magical exact
point, it's a much more ambiguous a "the refcount is now so large that
I'm not going to do GUP on this page any more". Being off by a number
of pages in case there's a race is just fine.
So you could do something like this (TOTALLY UNTESTED, and
whitespace-damaged on purpose - I don't want you to apply it blindly)
appended patch.
> And we have a few uses of bare get_page() in KVM code which might be
> subject to the same attack.
Note that you really have to have not just a get_page(), but some way
of lining up *billions* of them. Which really tends to be pretty hard.
Linus
----
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 9e732bb2c84a..52db7ff7c756 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -523,7 +523,8 @@ struct page *follow_huge_pd(struct vm_area_struct *vma,
page = pte_page(*ptep);
page += ((address & mask) >> PAGE_SHIFT);
if (flags & FOLL_GET)
- get_page(page);
+ if (!try_get_page(page))
+ page = NULL;
} else {
if (is_hugetlb_entry_migration(*ptep)) {
spin_unlock(ptl);
@@ -883,6 +884,8 @@ int gup_hugepte(pte_t *ptep, unsigned long sz,
unsigned long addr,
refs = 0;
head = pte_page(pte);
+ if (page_ref_count(head) < 0)
+ return 0;
page = head + ((addr & (sz-1)) >> PAGE_SHIFT);
do {
next prev parent reply other threads:[~2019-04-17 4:13 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-14 22:40 Linux 5.1-rc5 Linus Torvalds
2019-04-15 5:19 ` Christoph Hellwig
2019-04-15 16:17 ` Linus Torvalds
2019-04-16 9:09 ` Martin Schwidefsky
2019-04-16 12:06 ` Martin Schwidefsky
2019-04-16 16:16 ` Linus Torvalds
2019-04-16 16:49 ` Linus Torvalds
2019-04-17 7:46 ` Martin Schwidefsky
2019-04-17 8:02 ` Martin Schwidefsky
2019-04-17 16:57 ` Linus Torvalds
2019-04-18 8:02 ` Martin Schwidefsky
2019-04-18 15:49 ` Linus Torvalds
2019-04-18 18:41 ` Martin Schwidefsky
2019-04-19 13:33 ` Martin Schwidefsky
2019-04-19 17:27 ` Linus Torvalds
2019-04-23 15:38 ` Martin Schwidefsky
2019-04-23 16:06 ` Linus Torvalds
2019-04-17 3:38 ` Michael Ellerman
2019-04-17 4:13 ` Linus Torvalds [this message]
2019-05-02 12:21 ` Greg KH
2019-05-02 14:17 ` Martin Schwidefsky
2019-05-02 14:31 ` Greg KH
2019-05-02 15:10 ` Martin Schwidefsky
2019-05-20 11:09 ` Greg KH
2019-05-03 13:31 ` Michael Ellerman
2019-05-02 23:15 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHk-=wi2HxyJoH3xhr_ytM3gf1mkvq8Dq9Do+EdNZrm8KjV_6w@mail.gmail.com' \
--to=torvalds@linux-foundation.org \
--cc=aneesh.kumar@linux.ibm.com \
--cc=hch@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mpe@ellerman.id.au \
--cc=npiggin@gmail.com \
--cc=paulus@ozlabs.org \
--cc=schwidefsky@de.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).