linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] mm: fix potential pte_unmap_unlock pte error
@ 2020-10-15 12:15 Shijie Luo
  2020-10-15 12:58 ` osalvador
  2020-10-16 12:31 ` Michal Hocko
  0 siblings, 2 replies; 16+ messages in thread
From: Shijie Luo @ 2020-10-15 12:15 UTC (permalink / raw)
  To: akpm; +Cc: linux-mm, linux-kernel, linmiaohe, linfeilong, luoshijie1

When flags don't have MPOL_MF_MOVE or MPOL_MF_MOVE_ALL bits, code breaks
 and passing origin pte - 1 to pte_unmap_unlock seems like not a good idea.

Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
Signed-off-by: linmiaohe <linmiaohe@huawei.com>
---
 mm/mempolicy.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 3fde772ef5ef..01f088630d1d 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -571,7 +571,11 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 		} else
 			break;
 	}
-	pte_unmap_unlock(pte - 1, ptl);
+
+	if (addr >= end)
+		pte = pte - 1;
+
+	pte_unmap_unlock(pte, ptl);
 	cond_resched();
 
 	if (has_unmovable)
-- 
2.19.1


^ permalink raw reply related	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-15 12:15 [PATCH] mm: fix potential pte_unmap_unlock pte error Shijie Luo
@ 2020-10-15 12:58 ` osalvador
  2020-10-15 13:19   ` Shijie Luo
  2020-10-16 12:31 ` Michal Hocko
  1 sibling, 1 reply; 16+ messages in thread
From: osalvador @ 2020-10-15 12:58 UTC (permalink / raw)
  To: Shijie Luo; +Cc: akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On 2020-10-15 14:15, Shijie Luo wrote:
> When flags don't have MPOL_MF_MOVE or MPOL_MF_MOVE_ALL bits, code 
> breaks
>  and passing origin pte - 1 to pte_unmap_unlock seems like not a good 
> idea.
> 
> Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
> Signed-off-by: linmiaohe <linmiaohe@huawei.com>
> ---
>  mm/mempolicy.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 3fde772ef5ef..01f088630d1d 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -571,7 +571,11 @@ static int queue_pages_pte_range(pmd_t *pmd,
> unsigned long addr,
>  		} else
>  			break;
>  	}
> -	pte_unmap_unlock(pte - 1, ptl);
> +
> +	if (addr >= end)
> +		pte = pte - 1;
> +
> +	pte_unmap_unlock(pte, ptl);

But this is still wrong, isn't it?
Unless I am missing something, this is "only" important under 
CONFIG_HIGHPTE.

We have:

pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);

which under CONFIG_HIGHPTE does a kmap_atomoc.

Now, we either break the loop in the first pass because of 
!(MPOL_MF_MOVE | MPOL_MF_MOVE_ALL),
or we keep incrementing pte by every pass.
Either way is wrong, because the pointer kunmap_atomic gets will not be 
the same (since we incremented pte).

Or is the loop meant to be running only once, so pte - 1 will bring us 
back to the original pte?



^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-15 12:58 ` osalvador
@ 2020-10-15 13:19   ` Shijie Luo
  0 siblings, 0 replies; 16+ messages in thread
From: Shijie Luo @ 2020-10-15 13:19 UTC (permalink / raw)
  To: osalvador; +Cc: akpm, linux-mm, linux-kernel, linmiaohe, linfeilong


On 2020/10/15 20:58, osalvador@suse.de wrote:
> On 2020-10-15 14:15, Shijie Luo wrote:
>> When flags don't have MPOL_MF_MOVE or MPOL_MF_MOVE_ALL bits, code breaks
>>  and passing origin pte - 1 to pte_unmap_unlock seems like not a good 
>> idea.
>>
>> Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
>> Signed-off-by: linmiaohe <linmiaohe@huawei.com>
>> ---
>>  mm/mempolicy.c | 6 +++++-
>>  1 file changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index 3fde772ef5ef..01f088630d1d 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -571,7 +571,11 @@ static int queue_pages_pte_range(pmd_t *pmd,
>> unsigned long addr,
>>          } else
>>              break;
>>      }
>> -    pte_unmap_unlock(pte - 1, ptl);
>> +
>> +    if (addr >= end)
>> +        pte = pte - 1;
>> +
>> +    pte_unmap_unlock(pte, ptl);
>
> But this is still wrong, isn't it?
> Unless I am missing something, this is "only" important under 
> CONFIG_HIGHPTE.
>
> We have:
>
> pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
>
> which under CONFIG_HIGHPTE does a kmap_atomoc.
>
> Now, we either break the loop in the first pass because of 
> !(MPOL_MF_MOVE | MPOL_MF_MOVE_ALL),
> or we keep incrementing pte by every pass.
> Either way is wrong, because the pointer kunmap_atomic gets will not 
> be the same (since we incremented pte).
>
> Or is the loop meant to be running only once, so pte - 1 will bring us 
> back to the original pte?
>
> .

Thanks for your reply, if we break the loop in the first pass, the pte 
pointer will not be incremented,

pte - 1 equals original pte - 1,  because we only increase pte pointer 
when not break the loop.


^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-15 12:15 [PATCH] mm: fix potential pte_unmap_unlock pte error Shijie Luo
  2020-10-15 12:58 ` osalvador
@ 2020-10-16 12:31 ` Michal Hocko
  2020-10-16 12:37   ` osalvador
  1 sibling, 1 reply; 16+ messages in thread
From: Michal Hocko @ 2020-10-16 12:31 UTC (permalink / raw)
  To: Shijie Luo; +Cc: akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On Thu 15-10-20 08:15:34, Shijie Luo wrote:
> When flags don't have MPOL_MF_MOVE or MPOL_MF_MOVE_ALL bits, code breaks
>  and passing origin pte - 1 to pte_unmap_unlock seems like not a good idea.

Yes the code is suspicious to say the least. At least mbind can reach to
here with both MPOL_MF_MOVE, MPOL_MF_MOVE_ALL unset and then the pte
would be pointing outside of the current pmd.

I do not like the fix though. The code is really confusing. Why should
we check for flags in each iteration of the loop when it cannot change?
Also why should we take the ptl lock in the first place when the look is
broken out immediately?

I have to admit that I do not fully understand a7f40cfe3b7ad so this
should be carefuly evaluated.

If anything something like below would be a better fix

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index eddbe4e56c73..7877b36a5a6d 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -539,6 +539,10 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 	if (pmd_trans_unstable(pmd))
 		return 0;
 
+	/* A COMMENT GOES HERE. */
+	if (!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)))
+		return -EIO;
+
 	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
 	for (; addr != end; pte++, addr += PAGE_SIZE) {
 		if (!pte_present(*pte))
@@ -554,28 +558,26 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 			continue;
 		if (!queue_pages_required(page, qp))
 			continue;
-		if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
-			/* MPOL_MF_STRICT must be specified if we get here */
-			if (!vma_migratable(vma)) {
-				has_unmovable = true;
-				break;
-			}
 
-			/*
-			 * Do not abort immediately since there may be
-			 * temporary off LRU pages in the range.  Still
-			 * need migrate other LRU pages.
-			 */
-			if (migrate_page_add(page, qp->pagelist, flags))
-				has_unmovable = true;
-		} else
+		/* MPOL_MF_STRICT must be specified if we get here */
+		if (!vma_migratable(vma)) {
+			has_unmovable = true;
 			break;
+		}
+
+		/*
+		 * Do not abort immediately since there may be
+		 * temporary off LRU pages in the range.  Still
+		 * need migrate other LRU pages.
+		 */
+		if (migrate_page_add(page, qp->pagelist, flags))
+			has_unmovable = true;
 	}
 	pte_unmap_unlock(pte - 1, ptl);
 	cond_resched();
 
 	if (has_unmovable)
 		return 1;
 	return addr != end ? -EIO : 0;
 }
-- 
Michal Hocko
SUSE Labs

^ permalink raw reply related	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-16 12:31 ` Michal Hocko
@ 2020-10-16 12:37   ` osalvador
  2020-10-16 13:11     ` Michal Hocko
  0 siblings, 1 reply; 16+ messages in thread
From: osalvador @ 2020-10-16 12:37 UTC (permalink / raw)
  To: Michal Hocko
  Cc: Shijie Luo, akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On 2020-10-16 14:31, Michal Hocko wrote:
> I do not like the fix though. The code is really confusing. Why should
> we check for flags in each iteration of the loop when it cannot change?
> Also why should we take the ptl lock in the first place when the look 
> is
> broken out immediately?

About checking the flags:

https://lore.kernel.org/linux-mm/20190320081643.3c4m5tec5vx653sn@d104.suse.de/#t


^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-16 12:37   ` osalvador
@ 2020-10-16 13:11     ` Michal Hocko
  2020-10-16 13:15       ` Michal Hocko
  0 siblings, 1 reply; 16+ messages in thread
From: Michal Hocko @ 2020-10-16 13:11 UTC (permalink / raw)
  To: osalvador; +Cc: Shijie Luo, akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On Fri 16-10-20 14:37:08, osalvador@suse.de wrote:
> On 2020-10-16 14:31, Michal Hocko wrote:
> > I do not like the fix though. The code is really confusing. Why should
> > we check for flags in each iteration of the loop when it cannot change?
> > Also why should we take the ptl lock in the first place when the look is
> > broken out immediately?
> 
> About checking the flags:
> 
> https://lore.kernel.org/linux-mm/20190320081643.3c4m5tec5vx653sn@d104.suse.de/#t

This didn't really help. Maybe the code was different back then but
right now the code doesn't make much sense TBH. The only reason to check
inside the loop would be to have a completely unpopulated address range.
Note about MPOL_MF_STRICT is not checked explicitly and I do not see how
it makes any difference.

Anyway this function would benefit from some uncluttering!

-- 
Michal Hocko
SUSE Labs

^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-16 13:11     ` Michal Hocko
@ 2020-10-16 13:15       ` Michal Hocko
  2020-10-16 13:42         ` Michal Hocko
  0 siblings, 1 reply; 16+ messages in thread
From: Michal Hocko @ 2020-10-16 13:15 UTC (permalink / raw)
  To: osalvador; +Cc: Shijie Luo, akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On Fri 16-10-20 15:11:17, Michal Hocko wrote:
> On Fri 16-10-20 14:37:08, osalvador@suse.de wrote:
> > On 2020-10-16 14:31, Michal Hocko wrote:
> > > I do not like the fix though. The code is really confusing. Why should
> > > we check for flags in each iteration of the loop when it cannot change?
> > > Also why should we take the ptl lock in the first place when the look is
> > > broken out immediately?
> > 
> > About checking the flags:
> > 
> > https://lore.kernel.org/linux-mm/20190320081643.3c4m5tec5vx653sn@d104.suse.de/#t
> 
> This didn't really help. Maybe the code was different back then but
> right now the code doesn't make much sense TBH. The only reason to check
> inside the loop would be to have a completely unpopulated address range.
> Note about MPOL_MF_STRICT is not checked explicitly and I do not see how
> it makes any difference.

Ohh, I have missed queue_pages_required. Let me think some more.

-- 
Michal Hocko
SUSE Labs

^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-16 13:15       ` Michal Hocko
@ 2020-10-16 13:42         ` Michal Hocko
  2020-10-16 14:05           ` osalvador
  0 siblings, 1 reply; 16+ messages in thread
From: Michal Hocko @ 2020-10-16 13:42 UTC (permalink / raw)
  To: osalvador; +Cc: Shijie Luo, akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On Fri 16-10-20 15:15:32, Michal Hocko wrote:
> On Fri 16-10-20 15:11:17, Michal Hocko wrote:
> > On Fri 16-10-20 14:37:08, osalvador@suse.de wrote:
> > > On 2020-10-16 14:31, Michal Hocko wrote:
> > > > I do not like the fix though. The code is really confusing. Why should
> > > > we check for flags in each iteration of the loop when it cannot change?
> > > > Also why should we take the ptl lock in the first place when the look is
> > > > broken out immediately?
> > > 
> > > About checking the flags:
> > > 
> > > https://lore.kernel.org/linux-mm/20190320081643.3c4m5tec5vx653sn@d104.suse.de/#t
> > 
> > This didn't really help. Maybe the code was different back then but
> > right now the code doesn't make much sense TBH. The only reason to check
> > inside the loop would be to have a completely unpopulated address range.
> > Note about MPOL_MF_STRICT is not checked explicitly and I do not see how
> > it makes any difference.
> 
> Ohh, I have missed queue_pages_required. Let me think some more.

OK, I finally managed to convince my friday brain to think and grasped
what the code is intended to do. The loop is hairy and we want to
prevent from spurious EIO when all the pages are on a proper node. So
the check has to be done inside the loop. Anyway I would find the
following fix less error prone and easier to follow
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index eddbe4e56c73..8cc1fc9c4d13 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -525,7 +525,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 	unsigned long flags = qp->flags;
 	int ret;
 	bool has_unmovable = false;
-	pte_t *pte;
+	pte_t *pte, *mapped_pte;
 	spinlock_t *ptl;
 
 	ptl = pmd_trans_huge_lock(pmd, vma);
@@ -539,7 +539,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 	if (pmd_trans_unstable(pmd))
 		return 0;
 
-	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+	mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
 	for (; addr != end; pte++, addr += PAGE_SIZE) {
 		if (!pte_present(*pte))
 			continue;
@@ -571,7 +571,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 		} else
 			break;
 	}
-	pte_unmap_unlock(pte - 1, ptl);
+	pte_unmap_unlock(mapped_pte, ptl);
 	cond_resched();
 
 	if (has_unmovable)
-- 
Michal Hocko
SUSE Labs

^ permalink raw reply related	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-16 13:42         ` Michal Hocko
@ 2020-10-16 14:05           ` osalvador
  2020-10-17  1:55             ` Shijie Luo
  0 siblings, 1 reply; 16+ messages in thread
From: osalvador @ 2020-10-16 14:05 UTC (permalink / raw)
  To: Michal Hocko
  Cc: Shijie Luo, akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On 2020-10-16 15:42, Michal Hocko wrote:
> OK, I finally managed to convince my friday brain to think and grasped
> what the code is intended to do. The loop is hairy and we want to
> prevent from spurious EIO when all the pages are on a proper node. So
> the check has to be done inside the loop. Anyway I would find the
> following fix less error prone and easier to follow
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index eddbe4e56c73..8cc1fc9c4d13 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -525,7 +525,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
> unsigned long addr,
>  	unsigned long flags = qp->flags;
>  	int ret;
>  	bool has_unmovable = false;
> -	pte_t *pte;
> +	pte_t *pte, *mapped_pte;
>  	spinlock_t *ptl;
> 
>  	ptl = pmd_trans_huge_lock(pmd, vma);
> @@ -539,7 +539,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
> unsigned long addr,
>  	if (pmd_trans_unstable(pmd))
>  		return 0;
> 
> -	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
> +	mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
>  	for (; addr != end; pte++, addr += PAGE_SIZE) {
>  		if (!pte_present(*pte))
>  			continue;
> @@ -571,7 +571,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
> unsigned long addr,
>  		} else
>  			break;
>  	}
> -	pte_unmap_unlock(pte - 1, ptl);
> +	pte_unmap_unlock(mapped_pte, ptl);
>  	cond_resched();
> 
>  	if (has_unmovable)

It is more clear to grasp, definitely.


^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: fix potential pte_unmap_unlock pte error
  2020-10-16 14:05           ` osalvador
@ 2020-10-17  1:55             ` Shijie Luo
  0 siblings, 0 replies; 16+ messages in thread
From: Shijie Luo @ 2020-10-17  1:55 UTC (permalink / raw)
  To: osalvador, Michal Hocko
  Cc: akpm, linux-mm, linux-kernel, linmiaohe, linfeilong

On 2020/10/16 22:05, osalvador@suse.de wrote:
> On 2020-10-16 15:42, Michal Hocko wrote:
>> OK, I finally managed to convince my friday brain to think and grasped
>> what the code is intended to do. The loop is hairy and we want to
>> prevent from spurious EIO when all the pages are on a proper node. So
>> the check has to be done inside the loop. Anyway I would find the
>> following fix less error prone and easier to follow
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index eddbe4e56c73..8cc1fc9c4d13 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -525,7 +525,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
>> unsigned long addr,
>>      unsigned long flags = qp->flags;
>>      int ret;
>>      bool has_unmovable = false;
>> -    pte_t *pte;
>> +    pte_t *pte, *mapped_pte;
>>      spinlock_t *ptl;
>>
>>      ptl = pmd_trans_huge_lock(pmd, vma);
>> @@ -539,7 +539,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
>> unsigned long addr,
>>      if (pmd_trans_unstable(pmd))
>>          return 0;
>>
>> -    pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
>> +    mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
>>      for (; addr != end; pte++, addr += PAGE_SIZE) {
>>          if (!pte_present(*pte))
>>              continue;
>> @@ -571,7 +571,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
>> unsigned long addr,
>>          } else
>>              break;
>>      }
>> -    pte_unmap_unlock(pte - 1, ptl);
>> +    pte_unmap_unlock(mapped_pte, ptl);
>>      cond_resched();
>>
>>      if (has_unmovable)
>
> It is more clear to grasp, definitely.
Yeah, this one is more comprehensible, I 'll send a v2 patch, thank you.

^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: Fix potential pte_unmap_unlock pte error
  2021-01-24  2:01       ` Andrew Morton
@ 2021-01-25  2:04         ` Miaohe Lin
  0 siblings, 0 replies; 16+ messages in thread
From: Miaohe Lin @ 2021-01-25  2:04 UTC (permalink / raw)
  To: Andrew Morton
  Cc: tglx, dave.hansen, jpoimboe, linux-mm, linux-kernel, Andi Kleen

Hi:
On 2021/1/24 10:01, Andrew Morton wrote:
> On Fri, 22 Jan 2021 16:27:23 +0800 Miaohe Lin <linmiaohe@huawei.com> wrote:
> 
>> Hi Andrew:
>> On 2021/1/14 10:51, Miaohe Lin wrote:
>>> Hi:
>>> On 2021/1/11 1:14, Andi Kleen wrote:
>>>> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
>>>>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
>>>>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
>>>>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
>>>>> be passed to pte_unmap_unlock.
>>>>
>>>> Thanks.
>>>>
>>>> While the fix is correct, I'm not sure if it actually is a real bug. Is there
>>>> any architecture that would do something else than unlocking the underlying
>>>> page?  If it's just the underlying page then it should be always the same
>>>> page, so no bug.
>>>>
>>>
>>> It's just a theoretical issue via code inspection.
>>
>> Should I send a new one without Cc statle or just drop this patch? Thanks.
> 
> Your patch makes the code much less scary looking.  I added Andi's
> observation to the changelog, removed the cc:stable and queued it up,
> thanks.
> 
> .
> 

Sounds reasonable. Many thanks for doing this!

^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: Fix potential pte_unmap_unlock pte error
  2021-01-22  8:27     ` Miaohe Lin
@ 2021-01-24  2:01       ` Andrew Morton
  2021-01-25  2:04         ` Miaohe Lin
  0 siblings, 1 reply; 16+ messages in thread
From: Andrew Morton @ 2021-01-24  2:01 UTC (permalink / raw)
  To: Miaohe Lin
  Cc: tglx, dave.hansen, jpoimboe, linux-mm, linux-kernel, Andi Kleen

On Fri, 22 Jan 2021 16:27:23 +0800 Miaohe Lin <linmiaohe@huawei.com> wrote:

> Hi Andrew:
> On 2021/1/14 10:51, Miaohe Lin wrote:
> > Hi:
> > On 2021/1/11 1:14, Andi Kleen wrote:
> >> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
> >>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
> >>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
> >>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
> >>> be passed to pte_unmap_unlock.
> >>
> >> Thanks.
> >>
> >> While the fix is correct, I'm not sure if it actually is a real bug. Is there
> >> any architecture that would do something else than unlocking the underlying
> >> page?  If it's just the underlying page then it should be always the same
> >> page, so no bug.
> >>
> > 
> > It's just a theoretical issue via code inspection.
> 
> Should I send a new one without Cc statle or just drop this patch? Thanks.

Your patch makes the code much less scary looking.  I added Andi's
observation to the changelog, removed the cc:stable and queued it up,
thanks.


^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: Fix potential pte_unmap_unlock pte error
  2021-01-14  2:51   ` Miaohe Lin
@ 2021-01-22  8:27     ` Miaohe Lin
  2021-01-24  2:01       ` Andrew Morton
  0 siblings, 1 reply; 16+ messages in thread
From: Miaohe Lin @ 2021-01-22  8:27 UTC (permalink / raw)
  To: Andrew Morton
  Cc: tglx, dave.hansen, jpoimboe, linux-mm, linux-kernel, Andi Kleen

Hi Andrew:
On 2021/1/14 10:51, Miaohe Lin wrote:
> Hi:
> On 2021/1/11 1:14, Andi Kleen wrote:
>> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
>>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
>>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
>>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
>>> be passed to pte_unmap_unlock.
>>
>> Thanks.
>>
>> While the fix is correct, I'm not sure if it actually is a real bug. Is there
>> any architecture that would do something else than unlocking the underlying
>> page?  If it's just the underlying page then it should be always the same
>> page, so no bug.
>>
> 
> It's just a theoretical issue via code inspection.

Should I send a new one without Cc statle or just drop this patch? Thanks.

> 
>> That said of course the change is the right thing for main line, but probably doesn't
>> need to be backported.
>>
> 
> So it should not be backported. Should I resend a patch or Andrew would kindly do this?
> 
>> -Andi
>> .
>>
> 
> Many thanks for review and reply.
>

^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: Fix potential pte_unmap_unlock pte error
  2021-01-10 17:14 ` Andi Kleen
@ 2021-01-14  2:51   ` Miaohe Lin
  2021-01-22  8:27     ` Miaohe Lin
  0 siblings, 1 reply; 16+ messages in thread
From: Miaohe Lin @ 2021-01-14  2:51 UTC (permalink / raw)
  To: Andi Kleen, Andrew Morton
  Cc: tglx, dave.hansen, jpoimboe, linux-mm, linux-kernel

Hi:
On 2021/1/11 1:14, Andi Kleen wrote:
> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
>> be passed to pte_unmap_unlock.
> 
> Thanks.
> 
> While the fix is correct, I'm not sure if it actually is a real bug. Is there
> any architecture that would do something else than unlocking the underlying
> page?  If it's just the underlying page then it should be always the same
> page, so no bug.
> 

It's just a theoretical issue via code inspection.

> That said of course the change is the right thing for main line, but probably doesn't
> need to be backported.
> 

So it should not be backported. Should I resend a patch or Andrew would kindly do this?

> -Andi
> .
> 

Many thanks for review and reply.

^ permalink raw reply	[flat|nested] 16+ messages in thread

* Re: [PATCH] mm: Fix potential pte_unmap_unlock pte error
  2021-01-09  8:01 [PATCH] mm: Fix " Miaohe Lin
@ 2021-01-10 17:14 ` Andi Kleen
  2021-01-14  2:51   ` Miaohe Lin
  0 siblings, 1 reply; 16+ messages in thread
From: Andi Kleen @ 2021-01-10 17:14 UTC (permalink / raw)
  To: Miaohe Lin; +Cc: akpm, tglx, dave.hansen, jpoimboe, linux-mm, linux-kernel

On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
> we would break the loop with pte unchanged. Then the wrong pte - 1 would
> be passed to pte_unmap_unlock.

Thanks.

While the fix is correct, I'm not sure if it actually is a real bug. Is there
any architecture that would do something else than unlocking the underlying
page?  If it's just the underlying page then it should be always the same
page, so no bug.

That said of course the change is the right thing for main line, but probably doesn't
need to be backported.

-Andi

^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH] mm: Fix potential pte_unmap_unlock pte error
@ 2021-01-09  8:01 Miaohe Lin
  2021-01-10 17:14 ` Andi Kleen
  0 siblings, 1 reply; 16+ messages in thread
From: Miaohe Lin @ 2021-01-09  8:01 UTC (permalink / raw)
  To: akpm; +Cc: tglx, dave.hansen, ak, jpoimboe, linux-mm, linux-kernel, linmiaohe

Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
we would break the loop with pte unchanged. Then the wrong pte - 1 would
be passed to pte_unmap_unlock.

Fixes: 42e4089c789 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: stable@kernel.org
---
 mm/memory.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index feff48e1465a..351b78ebd5a4 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2165,11 +2165,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
 			unsigned long addr, unsigned long end,
 			unsigned long pfn, pgprot_t prot)
 {
-	pte_t *pte;
+	pte_t *pte, *mapped_pte;
 	spinlock_t *ptl;
 	int err = 0;
 
-	pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+	mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
 	if (!pte)
 		return -ENOMEM;
 	arch_enter_lazy_mmu_mode();
@@ -2183,7 +2183,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
 		pfn++;
 	} while (pte++, addr += PAGE_SIZE, addr != end);
 	arch_leave_lazy_mmu_mode();
-	pte_unmap_unlock(pte - 1, ptl);
+	pte_unmap_unlock(mapped_pte, ptl);
 	return err;
 }
 
-- 
2.19.1


^ permalink raw reply related	[flat|nested] 16+ messages in thread

end of thread, other threads:[~2021-01-25  2:15 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-15 12:15 [PATCH] mm: fix potential pte_unmap_unlock pte error Shijie Luo
2020-10-15 12:58 ` osalvador
2020-10-15 13:19   ` Shijie Luo
2020-10-16 12:31 ` Michal Hocko
2020-10-16 12:37   ` osalvador
2020-10-16 13:11     ` Michal Hocko
2020-10-16 13:15       ` Michal Hocko
2020-10-16 13:42         ` Michal Hocko
2020-10-16 14:05           ` osalvador
2020-10-17  1:55             ` Shijie Luo
2021-01-09  8:01 [PATCH] mm: Fix " Miaohe Lin
2021-01-10 17:14 ` Andi Kleen
2021-01-14  2:51   ` Miaohe Lin
2021-01-22  8:27     ` Miaohe Lin
2021-01-24  2:01       ` Andrew Morton
2021-01-25  2:04         ` Miaohe Lin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).