| Message ID | 20220805110329.80540-3-david@redhat.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | mm/hugetlb: fix write-fault handling for shared mappings | expand |
On Fri, Aug 05, 2022 at 01:03:29PM +0200, David Hildenbrand wrote: > Let's add a safety net if we ever get (again) a write-fault on a R/O-mapped > page in a shared mapping, in which case we simply have to map the > page writable. > > VM_MAYSHARE handling in hugetlb_fault() for FAULT_FLAG_WRITE > indicates that this was at least envisioned, but could never have worked > as expected. This theoretically paves the way for softdirty tracking > support in hugetlb. > > Tested without the fix for softdirty tracking. > > Note that there is no need to do any kind of reservation in hugetlb_fault() > in this case ... because we already have a hugetlb page mapped R/O > that we will simply map writable and we are not dealing with COW/unsharing. > > Signed-off-by: David Hildenbrand <david@redhat.com> > --- > mm/hugetlb.c | 21 ++++++++++++++------- > 1 file changed, 14 insertions(+), 7 deletions(-) > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > index a18c071c294e..bbab7aa9d8f8 100644 > --- a/mm/hugetlb.c > +++ b/mm/hugetlb.c > @@ -5233,6 +5233,16 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, > VM_BUG_ON(unshare && (flags & FOLL_WRITE)); > VM_BUG_ON(!unshare && !(flags & FOLL_WRITE)); > > + /* Let's take out shared mappings first, this should be a rare event. */ > + if (unlikely(vma->vm_flags & VM_MAYSHARE)) { Should we check VM_SHARED instead? > + if (unshare) > + return 0; Curious when will this happen especially if we switch to VM_SHARED above. Shouldn't "unshare" not happen at all on a shared region? > + if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE))) > + return VM_FAULT_SIGSEGV; I had a feeling that you just want to double check we have write permission, but IIUC this should be checked far earlier or we'll have problem. No strong opinion if so, but I'd suggest dropping this one, otherwise we could add tons of WARN_ON_ONCE() in anywhere in the page fault stack and they mostly won't trigger at all. > + set_huge_ptep_writable(vma, haddr, ptep); Do we wanna set dirty bits too? > + return 0; > + }
On 05.08.22 20:12, Peter Xu wrote: > On Fri, Aug 05, 2022 at 01:03:29PM +0200, David Hildenbrand wrote: >> Let's add a safety net if we ever get (again) a write-fault on a R/O-mapped >> page in a shared mapping, in which case we simply have to map the >> page writable. >> >> VM_MAYSHARE handling in hugetlb_fault() for FAULT_FLAG_WRITE >> indicates that this was at least envisioned, but could never have worked >> as expected. This theoretically paves the way for softdirty tracking >> support in hugetlb. >> >> Tested without the fix for softdirty tracking. >> >> Note that there is no need to do any kind of reservation in hugetlb_fault() >> in this case ... because we already have a hugetlb page mapped R/O >> that we will simply map writable and we are not dealing with COW/unsharing. >> >> Signed-off-by: David Hildenbrand <david@redhat.com> >> --- >> mm/hugetlb.c | 21 ++++++++++++++------- >> 1 file changed, 14 insertions(+), 7 deletions(-) >> >> diff --git a/mm/hugetlb.c b/mm/hugetlb.c >> index a18c071c294e..bbab7aa9d8f8 100644 >> --- a/mm/hugetlb.c >> +++ b/mm/hugetlb.c >> @@ -5233,6 +5233,16 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, >> VM_BUG_ON(unshare && (flags & FOLL_WRITE)); >> VM_BUG_ON(!unshare && !(flags & FOLL_WRITE)); >> >> + /* Let's take out shared mappings first, this should be a rare event. */ >> + if (unlikely(vma->vm_flags & VM_MAYSHARE)) { > > Should we check VM_SHARED instead? Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is unfortunately wrong. If you're curious, take a look at f83a275dbc5c ("mm: account for MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") and mmap() code. Long story short: if the file is read-only, we only have VM_MAYSHARE but not VM_SHARED (and consequently also not VM_MAYWRITE). > >> + if (unshare) >> + return 0; > > Curious when will this happen especially if we switch to VM_SHARED above. > Shouldn't "unshare" not happen at all on a shared region? FAULT_FLAG_UNSHARE is documented to behave like: "FAULT_FLAG_UNSHARE is ignored and treated like an ordinary read fault when no existing R/O-mapped anonymous page is encountered." It should currently not happen. Focus on should ;) > >> + if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE))) >> + return VM_FAULT_SIGSEGV; > > I had a feeling that you just want to double check we have write > permission, but IIUC this should be checked far earlier or we'll have > problem. No strong opinion if so, but I'd suggest dropping this one, > otherwise we could add tons of WARN_ON_ONCE() in anywhere in the page fault > stack and they mostly won't trigger at all. Not quite. We usually (!hugetlb) have maybe_mkwrite() all over the place. This is just an indication that we don't have maybe semantics here. But as we also don't have it for hugetlb anon code below, maybe I can just drop it. (or check it for both call paths) > >> + set_huge_ptep_writable(vma, haddr, ptep); > > Do we wanna set dirty bits too? set_huge_ptep_writable() handles that. Thanks!
On 08/05/22 14:12, Peter Xu wrote: > On Fri, Aug 05, 2022 at 01:03:29PM +0200, David Hildenbrand wrote: > > Let's add a safety net if we ever get (again) a write-fault on a R/O-mapped > > page in a shared mapping, in which case we simply have to map the > > page writable. > > > > + if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE))) > > + return VM_FAULT_SIGSEGV; > > I had a feeling that you just want to double check we have write > permission, but IIUC this should be checked far earlier or we'll have > problem. Back when I was exploring hugetlb softdirty support, this patch handled this condition by not calling into hugetlb_wp (was hugetlb_cow). https://lore.kernel.org/linux-mm/20210211000322.159437-3-mike.kravetz@oracle.com/ Here is a quickly updated version that was only tested with David's program.
On Fri, Aug 05, 2022 at 08:20:52PM +0200, David Hildenbrand wrote: > On 05.08.22 20:12, Peter Xu wrote: > > On Fri, Aug 05, 2022 at 01:03:29PM +0200, David Hildenbrand wrote: > >> Let's add a safety net if we ever get (again) a write-fault on a R/O-mapped > >> page in a shared mapping, in which case we simply have to map the > >> page writable. > >> > >> VM_MAYSHARE handling in hugetlb_fault() for FAULT_FLAG_WRITE > >> indicates that this was at least envisioned, but could never have worked > >> as expected. This theoretically paves the way for softdirty tracking > >> support in hugetlb. > >> > >> Tested without the fix for softdirty tracking. > >> > >> Note that there is no need to do any kind of reservation in hugetlb_fault() > >> in this case ... because we already have a hugetlb page mapped R/O > >> that we will simply map writable and we are not dealing with COW/unsharing. > >> > >> Signed-off-by: David Hildenbrand <david@redhat.com> > >> --- > >> mm/hugetlb.c | 21 ++++++++++++++------- > >> 1 file changed, 14 insertions(+), 7 deletions(-) > >> > >> diff --git a/mm/hugetlb.c b/mm/hugetlb.c > >> index a18c071c294e..bbab7aa9d8f8 100644 > >> --- a/mm/hugetlb.c > >> +++ b/mm/hugetlb.c > >> @@ -5233,6 +5233,16 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, > >> VM_BUG_ON(unshare && (flags & FOLL_WRITE)); > >> VM_BUG_ON(!unshare && !(flags & FOLL_WRITE)); > >> > >> + /* Let's take out shared mappings first, this should be a rare event. */ > >> + if (unlikely(vma->vm_flags & VM_MAYSHARE)) { > > > > Should we check VM_SHARED instead? > > Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is > unfortunately wrong. > > If you're curious, take a look at f83a275dbc5c ("mm: account for > MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") > and mmap() code. > > Long story short: if the file is read-only, we only have VM_MAYSHARE but > not VM_SHARED (and consequently also not VM_MAYWRITE). To ask in another way: if file is RO but mapped RW (mmap() will have VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here won't we grant write bit errornously while we shouldn't? As the user doesn't really have write permission to the file. > > > > >> + if (unshare) > >> + return 0; > > > > Curious when will this happen especially if we switch to VM_SHARED above. > > Shouldn't "unshare" not happen at all on a shared region? > > FAULT_FLAG_UNSHARE is documented to behave like: > > "FAULT_FLAG_UNSHARE is ignored and treated like an ordinary read fault > when no existing R/O-mapped anonymous page is encountered." > > It should currently not happen. Focus on should ;) OK. :) Then does it also mean that it should be better to turn into WARN_ON_ONCE()? It's just that it looks like a valid path if without it. > > > > >> + if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE))) > >> + return VM_FAULT_SIGSEGV; > > > > I had a feeling that you just want to double check we have write > > permission, but IIUC this should be checked far earlier or we'll have > > problem. No strong opinion if so, but I'd suggest dropping this one, > > otherwise we could add tons of WARN_ON_ONCE() in anywhere in the page fault > > stack and they mostly won't trigger at all. > > Not quite. We usually (!hugetlb) have maybe_mkwrite() all over the > place. This is just an indication that we don't have maybe semantics > here. But as we also don't have it for hugetlb anon code below, maybe I > can just drop it. (or check it for both call paths) Hmm, this reminded me to wonder how hugetlb handles FOLL_FORCE|FOLL_WRITE on RO regions. Maybe that check is needed, but however instead of warning and sigbus, we need to handle it? I'll need to read more on this later, but raise this up. > > > > >> + set_huge_ptep_writable(vma, haddr, ptep); > > > > Do we wanna set dirty bits too? > > set_huge_ptep_writable() handles that. Right, I noticed it right after I sent too.. Thanks,
>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is >> unfortunately wrong. >> >> If you're curious, take a look at f83a275dbc5c ("mm: account for >> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") >> and mmap() code. >> >> Long story short: if the file is read-only, we only have VM_MAYSHARE but >> not VM_SHARED (and consequently also not VM_MAYWRITE). > > To ask in another way: if file is RO but mapped RW (mmap() will have > VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here > won't we grant write bit errornously while we shouldn't? As the user > doesn't really have write permission to the file. Thus the VM_WRITE check. :) I wonder if we should just do it cleanly and introduce the maybe_mkwrite semantics here as well. Then there is no need for additional VM_WRITE checks and hugetlb will work just like !hugetlb. Thoughts? > >> >>> >>>> + if (unshare) >>>> + return 0; >>> >>> Curious when will this happen especially if we switch to VM_SHARED above. >>> Shouldn't "unshare" not happen at all on a shared region? >> >> FAULT_FLAG_UNSHARE is documented to behave like: >> >> "FAULT_FLAG_UNSHARE is ignored and treated like an ordinary read fault >> when no existing R/O-mapped anonymous page is encountered." >> >> It should currently not happen. Focus on should ;) > > OK. :) > > Then does it also mean that it should be better to turn into > WARN_ON_ONCE()? It's just that it looks like a valid path if without it. Well, it should work (and we handle the !hugetlb path) like that as well. So I'd want to avoid WARN_ON_ONCE() at least for that check. > >> >>> >>>> + if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE))) >>>> + return VM_FAULT_SIGSEGV; >>> >>> I had a feeling that you just want to double check we have write >>> permission, but IIUC this should be checked far earlier or we'll have >>> problem. No strong opinion if so, but I'd suggest dropping this one, >>> otherwise we could add tons of WARN_ON_ONCE() in anywhere in the page fault >>> stack and they mostly won't trigger at all. >> >> Not quite. We usually (!hugetlb) have maybe_mkwrite() all over the >> place. This is just an indication that we don't have maybe semantics >> here. But as we also don't have it for hugetlb anon code below, maybe I >> can just drop it. (or check it for both call paths) > > Hmm, this reminded me to wonder how hugetlb handles FOLL_FORCE|FOLL_WRITE > on RO regions. > > Maybe that check is needed, but however instead of warning and sigbus, we > need to handle it? We don't support FOLL_FORCE|FOLL_WRITE for hugetlb, but if we would, we'd need the maybe_mkwrite semantics. Fortunately I detest private hugetlb mappings / anon hugetlb pages and couldn't care less about debug access until it's actually a problem for someone :)
On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: > >> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is > >> unfortunately wrong. > >> > >> If you're curious, take a look at f83a275dbc5c ("mm: account for > >> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") > >> and mmap() code. > >> > >> Long story short: if the file is read-only, we only have VM_MAYSHARE but > >> not VM_SHARED (and consequently also not VM_MAYWRITE). > > > > To ask in another way: if file is RO but mapped RW (mmap() will have > > VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here > > won't we grant write bit errornously while we shouldn't? As the user > > doesn't really have write permission to the file. > > Thus the VM_WRITE check. :) > > I wonder if we should just do it cleanly and introduce the maybe_mkwrite > semantics here as well. Then there is no need for additional VM_WRITE > checks and hugetlb will work just like !hugetlb. Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail the cases where MAYSHARE && !SHARE - we used to silently let it pass. But then OTOH using WARN_ON_ONCE on the VM_WRITE check is probably not right, because iiuc it can be triggered easily by the userspace. E.g. as simple as mapping hugetlb as RO+shared then write to it? So maybe_mkwrite() seems not an option now - IIUC we really need that !VM_WRITE check to fail properly, but just without the warning to pollute dmesg? Thanks,
On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: > On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: > > >> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is > > >> unfortunately wrong. > > >> > > >> If you're curious, take a look at f83a275dbc5c ("mm: account for > > >> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") > > >> and mmap() code. > > >> > > >> Long story short: if the file is read-only, we only have VM_MAYSHARE but > > >> not VM_SHARED (and consequently also not VM_MAYWRITE). > > > > > > To ask in another way: if file is RO but mapped RW (mmap() will have > > > VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here > > > won't we grant write bit errornously while we shouldn't? As the user > > > doesn't really have write permission to the file. > > > > Thus the VM_WRITE check. :) > > > > I wonder if we should just do it cleanly and introduce the maybe_mkwrite > > semantics here as well. Then there is no need for additional VM_WRITE > > checks and hugetlb will work just like !hugetlb. > > Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail > the cases where MAYSHARE && !SHARE - we used to silently let it pass. Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly with/without the patch on any write to hugetlb RO regions. Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I don't see a problem. It also means I can't think of any valid case of having VM_WRITE when reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for hugetlbfs after all.
On 09.08.22 00:08, Peter Xu wrote: > On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: >> On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: >>>>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is >>>>> unfortunately wrong. >>>>> >>>>> If you're curious, take a look at f83a275dbc5c ("mm: account for >>>>> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") >>>>> and mmap() code. >>>>> >>>>> Long story short: if the file is read-only, we only have VM_MAYSHARE but >>>>> not VM_SHARED (and consequently also not VM_MAYWRITE). >>>> >>>> To ask in another way: if file is RO but mapped RW (mmap() will have >>>> VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here >>>> won't we grant write bit errornously while we shouldn't? As the user >>>> doesn't really have write permission to the file. >>> >>> Thus the VM_WRITE check. :) >>> >>> I wonder if we should just do it cleanly and introduce the maybe_mkwrite >>> semantics here as well. Then there is no need for additional VM_WRITE >>> checks and hugetlb will work just like !hugetlb. >> >> Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail >> the cases where MAYSHARE && !SHARE - we used to silently let it pass. > > Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly > with/without the patch on any write to hugetlb RO regions. > > Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE > here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I > don't see a problem. > > It also means I can't think of any valid case of having VM_WRITE when > reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. > Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for > hugetlbfs after all. > The main reason we'd have it would be to scream out lout and fail gracefully if someone would -- for example -- use it for something like FOLL_FORCE. I mean triggering a write fault without VM_WRITE on !hugetlb works, so it would be easy to assume that it similarly simply works for hugetlb as well. And the code most probably wouldn't even blow up immediately :)
On 10.08.22 11:37, David Hildenbrand wrote: > On 09.08.22 00:08, Peter Xu wrote: >> On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: >>> On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: >>>>>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is >>>>>> unfortunately wrong. >>>>>> >>>>>> If you're curious, take a look at f83a275dbc5c ("mm: account for >>>>>> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") >>>>>> and mmap() code. >>>>>> >>>>>> Long story short: if the file is read-only, we only have VM_MAYSHARE but >>>>>> not VM_SHARED (and consequently also not VM_MAYWRITE). >>>>> >>>>> To ask in another way: if file is RO but mapped RW (mmap() will have >>>>> VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here >>>>> won't we grant write bit errornously while we shouldn't? As the user >>>>> doesn't really have write permission to the file. >>>> >>>> Thus the VM_WRITE check. :) >>>> >>>> I wonder if we should just do it cleanly and introduce the maybe_mkwrite >>>> semantics here as well. Then there is no need for additional VM_WRITE >>>> checks and hugetlb will work just like !hugetlb. >>> >>> Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail >>> the cases where MAYSHARE && !SHARE - we used to silently let it pass. >> >> Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly >> with/without the patch on any write to hugetlb RO regions. >> >> Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE >> here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I >> don't see a problem. >> >> It also means I can't think of any valid case of having VM_WRITE when >> reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. >> Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for >> hugetlbfs after all. >> > > The main reason we'd have it would be to scream out lout and fail > gracefully if someone would -- for example -- use it for something like > FOLL_FORCE. I mean triggering a write fault without VM_WRITE on !hugetlb > works, so it would be easy to assume that it similarly simply works for > hugetlb as well. And the code most probably wouldn't even blow up > immediately :) > I propose the following change to hugetlb_wp(): diff --git a/mm/hugetlb.c b/mm/hugetlb.c index a18c071c294e..b92d30d3b33b 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5233,6 +5233,21 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, VM_BUG_ON(unshare && (flags & FOLL_WRITE)); VM_BUG_ON(!unshare && !(flags & FOLL_WRITE)); + /* + * hugetlb does not support FOLL_FORCE-style write faults that keep the + * PTE mapped R/O such as maybe_mkwrite() would do. + */ + if (WARN_ON_ONCE(!unshare && !(vma->vm_flags & VM_WRITE))) + return VM_FAULT_SIGSEGV; + + /* Let's take out shared mappings first, this should be a rare event. */ + if (unlikely(vma->vm_flags & VM_MAYSHARE)) { + if (unlikely(unshare)) + return 0; + set_huge_ptep_writable(vma, haddr, ptep); + return 0; + } +
On Wed, Aug 10, 2022 at 11:37:13AM +0200, David Hildenbrand wrote: > On 09.08.22 00:08, Peter Xu wrote: > > On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: > >> On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: > >>>>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is > >>>>> unfortunately wrong. > >>>>> > >>>>> If you're curious, take a look at f83a275dbc5c ("mm: account for > >>>>> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") > >>>>> and mmap() code. > >>>>> > >>>>> Long story short: if the file is read-only, we only have VM_MAYSHARE but > >>>>> not VM_SHARED (and consequently also not VM_MAYWRITE). > >>>> > >>>> To ask in another way: if file is RO but mapped RW (mmap() will have > >>>> VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here > >>>> won't we grant write bit errornously while we shouldn't? As the user > >>>> doesn't really have write permission to the file. > >>> > >>> Thus the VM_WRITE check. :) > >>> > >>> I wonder if we should just do it cleanly and introduce the maybe_mkwrite > >>> semantics here as well. Then there is no need for additional VM_WRITE > >>> checks and hugetlb will work just like !hugetlb. > >> > >> Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail > >> the cases where MAYSHARE && !SHARE - we used to silently let it pass. > > > > Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly > > with/without the patch on any write to hugetlb RO regions. > > > > Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE > > here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I > > don't see a problem. > > > > It also means I can't think of any valid case of having VM_WRITE when > > reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. > > Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for > > hugetlbfs after all. > > > > The main reason we'd have it would be to scream out lout and fail > gracefully if someone would -- for example -- use it for something like > FOLL_FORCE. Having that WARN_ON_ONCE() is okay to me, but just to double check we're on the same page: why there's concern on using FOLL_FORCE? IIUC we're talking about shared mappings here, then no FOLL_FORCE possible at all? IOW, "!is_cow_mapping()" should fail in check_vma_flags() already. The other thing is I'm wondering whether patch 2 should be postponed anyway so that we can wait for a full resolution of the problem from Mike. Thanks,
On 10.08.22 21:29, Peter Xu wrote: > On Wed, Aug 10, 2022 at 11:37:13AM +0200, David Hildenbrand wrote: >> On 09.08.22 00:08, Peter Xu wrote: >>> On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: >>>> On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: >>>>>>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is >>>>>>> unfortunately wrong. >>>>>>> >>>>>>> If you're curious, take a look at f83a275dbc5c ("mm: account for >>>>>>> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") >>>>>>> and mmap() code. >>>>>>> >>>>>>> Long story short: if the file is read-only, we only have VM_MAYSHARE but >>>>>>> not VM_SHARED (and consequently also not VM_MAYWRITE). >>>>>> >>>>>> To ask in another way: if file is RO but mapped RW (mmap() will have >>>>>> VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here >>>>>> won't we grant write bit errornously while we shouldn't? As the user >>>>>> doesn't really have write permission to the file. >>>>> >>>>> Thus the VM_WRITE check. :) >>>>> >>>>> I wonder if we should just do it cleanly and introduce the maybe_mkwrite >>>>> semantics here as well. Then there is no need for additional VM_WRITE >>>>> checks and hugetlb will work just like !hugetlb. >>>> >>>> Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail >>>> the cases where MAYSHARE && !SHARE - we used to silently let it pass. >>> >>> Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly >>> with/without the patch on any write to hugetlb RO regions. >>> >>> Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE >>> here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I >>> don't see a problem. >>> >>> It also means I can't think of any valid case of having VM_WRITE when >>> reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. >>> Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for >>> hugetlbfs after all. >>> >> >> The main reason we'd have it would be to scream out lout and fail >> gracefully if someone would -- for example -- use it for something like >> FOLL_FORCE. > > Having that WARN_ON_ONCE() is okay to me, but just to double check we're on > the same page: why there's concern on using FOLL_FORCE? IIUC we're talking > about shared mappings here, then no FOLL_FORCE possible at all? IOW, > "!is_cow_mapping()" should fail in check_vma_flags() already. This code path also covers the anon case. > > The other thing is I'm wondering whether patch 2 should be postponed anyway > so that we can wait for a full resolution of the problem from Mike. To make the code more robust and avoid any other such surprises I prefer to have this in rather earlier than later. As the commit says "Let's add a safety net ..."
On Wed, Aug 10, 2022 at 09:40:11PM +0200, David Hildenbrand wrote: > On 10.08.22 21:29, Peter Xu wrote: > > On Wed, Aug 10, 2022 at 11:37:13AM +0200, David Hildenbrand wrote: > >> On 09.08.22 00:08, Peter Xu wrote: > >>> On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: > >>>> On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: > >>>>>>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is > >>>>>>> unfortunately wrong. > >>>>>>> > >>>>>>> If you're curious, take a look at f83a275dbc5c ("mm: account for > >>>>>>> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") > >>>>>>> and mmap() code. > >>>>>>> > >>>>>>> Long story short: if the file is read-only, we only have VM_MAYSHARE but > >>>>>>> not VM_SHARED (and consequently also not VM_MAYWRITE). > >>>>>> > >>>>>> To ask in another way: if file is RO but mapped RW (mmap() will have > >>>>>> VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here > >>>>>> won't we grant write bit errornously while we shouldn't? As the user > >>>>>> doesn't really have write permission to the file. > >>>>> > >>>>> Thus the VM_WRITE check. :) > >>>>> > >>>>> I wonder if we should just do it cleanly and introduce the maybe_mkwrite > >>>>> semantics here as well. Then there is no need for additional VM_WRITE > >>>>> checks and hugetlb will work just like !hugetlb. > >>>> > >>>> Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail > >>>> the cases where MAYSHARE && !SHARE - we used to silently let it pass. > >>> > >>> Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly > >>> with/without the patch on any write to hugetlb RO regions. > >>> > >>> Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE > >>> here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I > >>> don't see a problem. > >>> > >>> It also means I can't think of any valid case of having VM_WRITE when > >>> reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. > >>> Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for > >>> hugetlbfs after all. > >>> > >> > >> The main reason we'd have it would be to scream out lout and fail > >> gracefully if someone would -- for example -- use it for something like > >> FOLL_FORCE. > > > > Having that WARN_ON_ONCE() is okay to me, but just to double check we're on > > the same page: why there's concern on using FOLL_FORCE? IIUC we're talking > > about shared mappings here, then no FOLL_FORCE possible at all? IOW, > > "!is_cow_mapping()" should fail in check_vma_flags() already. > > This code path also covers the anon case. But this specific warning is under the VM_MAYSHARE if clause just added in this patch? My understanding is any FOLL_FORCE will always constantly fail before this patch, and it should keep failing as usual and I don't see any case it'll be failing at the warn_on_once here. So again, I'm fine with having the warning, but I just want to make sure what you want to capture is what you expected.. > > > > The other thing is I'm wondering whether patch 2 should be postponed anyway > > so that we can wait for a full resolution of the problem from Mike. > > To make the code more robust and avoid any other such surprises I prefer > to have this in rather earlier than later. > > As the commit says "Let's add a safety net ..." Sure, no strong opinion. I'll leave that to Mike. Thanks,
On 08/10/22 15:52, Peter Xu wrote: > On Wed, Aug 10, 2022 at 09:40:11PM +0200, David Hildenbrand wrote: > > On 10.08.22 21:29, Peter Xu wrote: > > > On Wed, Aug 10, 2022 at 11:37:13AM +0200, David Hildenbrand wrote: > > >> On 09.08.22 00:08, Peter Xu wrote: > > >>> On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: > > >>>> On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: > > >>>>>>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is > > >>>>>>> unfortunately wrong. > > >>>>>>> > > >>>>>>> If you're curious, take a look at f83a275dbc5c ("mm: account for > > >>>>>>> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") > > >>>>>>> and mmap() code. > > >>>>>>> > > >>>>>>> Long story short: if the file is read-only, we only have VM_MAYSHARE but > > >>>>>>> not VM_SHARED (and consequently also not VM_MAYWRITE). > > >>>>>> > > >>>>>> To ask in another way: if file is RO but mapped RW (mmap() will have > > >>>>>> VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here > > >>>>>> won't we grant write bit errornously while we shouldn't? As the user > > >>>>>> doesn't really have write permission to the file. > > >>>>> > > >>>>> Thus the VM_WRITE check. :) > > >>>>> > > >>>>> I wonder if we should just do it cleanly and introduce the maybe_mkwrite > > >>>>> semantics here as well. Then there is no need for additional VM_WRITE > > >>>>> checks and hugetlb will work just like !hugetlb. > > >>>> > > >>>> Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail > > >>>> the cases where MAYSHARE && !SHARE - we used to silently let it pass. > > >>> > > >>> Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly > > >>> with/without the patch on any write to hugetlb RO regions. > > >>> > > >>> Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE > > >>> here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I > > >>> don't see a problem. > > >>> > > >>> It also means I can't think of any valid case of having VM_WRITE when > > >>> reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. > > >>> Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for > > >>> hugetlbfs after all. > > >>> > > >> > > >> The main reason we'd have it would be to scream out lout and fail > > >> gracefully if someone would -- for example -- use it for something like > > >> FOLL_FORCE. > > > > > > Having that WARN_ON_ONCE() is okay to me, but just to double check we're on > > > the same page: why there's concern on using FOLL_FORCE? IIUC we're talking > > > about shared mappings here, then no FOLL_FORCE possible at all? IOW, > > > "!is_cow_mapping()" should fail in check_vma_flags() already. > > > > This code path also covers the anon case. > > But this specific warning is under the VM_MAYSHARE if clause just added in > this patch? > > My understanding is any FOLL_FORCE will always constantly fail before this > patch, and it should keep failing as usual and I don't see any case it'll > be failing at the warn_on_once here. > > So again, I'm fine with having the warning, but I just want to make sure > what you want to capture is what you expected.. > > > > > > > The other thing is I'm wondering whether patch 2 should be postponed anyway > > > so that we can wait for a full resolution of the problem from Mike. > > > > To make the code more robust and avoid any other such surprises I prefer > > to have this in rather earlier than later. > > > > As the commit says "Let's add a safety net ..." > > Sure, no strong opinion. I'll leave that to Mike. Thanks, > Sorry that I am not contributing to this thread more. Need to spend some time educating myself on the relatively new semantics here. As mentioned, softdirty is on my todo list but has been there for over a year. So, better to add a safety net until that code moves forward. However, just for clarification. The only way we KNOW of to encounter these situations today via softdirty. Patch 1 takes care of that. This patch catches any unknown ways we may get here. Correct? i.e. We don't really expect to exercise these code paths.
On 11.08.22 01:55, Mike Kravetz wrote: > On 08/10/22 15:52, Peter Xu wrote: >> On Wed, Aug 10, 2022 at 09:40:11PM +0200, David Hildenbrand wrote: >>> On 10.08.22 21:29, Peter Xu wrote: >>>> On Wed, Aug 10, 2022 at 11:37:13AM +0200, David Hildenbrand wrote: >>>>> On 09.08.22 00:08, Peter Xu wrote: >>>>>> On Mon, Aug 08, 2022 at 04:21:39PM -0400, Peter Xu wrote: >>>>>>> On Mon, Aug 08, 2022 at 06:25:21PM +0200, David Hildenbrand wrote: >>>>>>>>>> Relying on VM_SHARED to detect MAP_PRIVATE vs. MAP_SHARED is >>>>>>>>>> unfortunately wrong. >>>>>>>>>> >>>>>>>>>> If you're curious, take a look at f83a275dbc5c ("mm: account for >>>>>>>>>> MAP_SHARED mappings using VM_MAYSHARE and not VM_SHARED in hugetlbfs") >>>>>>>>>> and mmap() code. >>>>>>>>>> >>>>>>>>>> Long story short: if the file is read-only, we only have VM_MAYSHARE but >>>>>>>>>> not VM_SHARED (and consequently also not VM_MAYWRITE). >>>>>>>>> >>>>>>>>> To ask in another way: if file is RO but mapped RW (mmap() will have >>>>>>>>> VM_SHARED cleared but VM_MAYSHARE set), then if we check VM_MAYSHARE here >>>>>>>>> won't we grant write bit errornously while we shouldn't? As the user >>>>>>>>> doesn't really have write permission to the file. >>>>>>>> >>>>>>>> Thus the VM_WRITE check. :) >>>>>>>> >>>>>>>> I wonder if we should just do it cleanly and introduce the maybe_mkwrite >>>>>>>> semantics here as well. Then there is no need for additional VM_WRITE >>>>>>>> checks and hugetlb will work just like !hugetlb. >>>>>>> >>>>>>> Hmm yeah I think the VM_MAYSHARE check is correct, since we'll need to fail >>>>>>> the cases where MAYSHARE && !SHARE - we used to silently let it pass. >>>>>> >>>>>> Sorry I think this is a wrong statement I made.. IIUC we'll fail correctly >>>>>> with/without the patch on any write to hugetlb RO regions. >>>>>> >>>>>> Then I just don't see a difference on checking VM_SHARED or VM_MAYSHARE >>>>>> here, it's just that VM_MAYSHARE check should work too like VM_SHARED so I >>>>>> don't see a problem. >>>>>> >>>>>> It also means I can't think of any valid case of having VM_WRITE when >>>>>> reaching here, then the WARN_ON_ONCE() is okay but maybe also redundant. >>>>>> Using maybe_mkwrite() seems misleading to me if FOLL_FORCE not ready for >>>>>> hugetlbfs after all. >>>>>> >>>>> >>>>> The main reason we'd have it would be to scream out lout and fail >>>>> gracefully if someone would -- for example -- use it for something like >>>>> FOLL_FORCE. >>>> >>>> Having that WARN_ON_ONCE() is okay to me, but just to double check we're on >>>> the same page: why there's concern on using FOLL_FORCE? IIUC we're talking >>>> about shared mappings here, then no FOLL_FORCE possible at all? IOW, >>>> "!is_cow_mapping()" should fail in check_vma_flags() already. >>> >>> This code path also covers the anon case. >> >> But this specific warning is under the VM_MAYSHARE if clause just added in >> this patch? >> >> My understanding is any FOLL_FORCE will always constantly fail before this >> patch, and it should keep failing as usual and I don't see any case it'll >> be failing at the warn_on_once here. >> >> So again, I'm fine with having the warning, but I just want to make sure >> what you want to capture is what you expected.. >> >>>> >>>> The other thing is I'm wondering whether patch 2 should be postponed anyway >>>> so that we can wait for a full resolution of the problem from Mike. >>> >>> To make the code more robust and avoid any other such surprises I prefer >>> to have this in rather earlier than later. >>> >>> As the commit says "Let's add a safety net ..." >> >> Sure, no strong opinion. I'll leave that to Mike. Thanks, >> > > Sorry that I am not contributing to this thread more. Need to spend > some time educating myself on the relatively new semantics here. > > As mentioned, softdirty is on my todo list but has been there for over a > year. So, better to add a safety net until that code moves forward. > > However, just for clarification. The only way we KNOW of to encounter > these situations today via softdirty. Patch 1 takes care of that. This > patch catches any unknown ways we may get here. Correct? i.e. We don't > really expect to exercise these code paths. While I do love a good challenge on a Thursday morning, I wish I could spend less time writing reproducers and arguing about obviously shaky code ;) . Having that said, there is a flaw in uffd-wp that will end up in the same code path and similarly mess up. I'll resend including the reproducer. Note that I'll be on vacation for ~ 1.5 weeks.
diff --git a/mm/hugetlb.c b/mm/hugetlb.c index a18c071c294e..bbab7aa9d8f8 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5233,6 +5233,16 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, VM_BUG_ON(unshare && (flags & FOLL_WRITE)); VM_BUG_ON(!unshare && !(flags & FOLL_WRITE)); + /* Let's take out shared mappings first, this should be a rare event. */ + if (unlikely(vma->vm_flags & VM_MAYSHARE)) { + if (unshare) + return 0; + if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE))) + return VM_FAULT_SIGSEGV; + set_huge_ptep_writable(vma, haddr, ptep); + return 0; + } + pte = huge_ptep_get(ptep); old_page = pte_page(pte); @@ -5767,12 +5777,11 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, * If we are going to COW/unshare the mapping later, we examine the * pending reservations for this page now. This will ensure that any * allocations necessary to record that reservation occur outside the - * spinlock. For private mappings, we also lookup the pagecache - * page now as it is used to determine if a reservation has been - * consumed. + * spinlock. Also lookup the pagecache page now as it is used to + * determine if a reservation has been consumed. */ if ((flags & (FAULT_FLAG_WRITE|FAULT_FLAG_UNSHARE)) && - !huge_pte_write(entry)) { + !(vma->vm_flags & VM_MAYSHARE) && !huge_pte_write(entry)) { if (vma_needs_reservation(h, vma, haddr) < 0) { ret = VM_FAULT_OOM; goto out_mutex; @@ -5780,9 +5789,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, /* Just decrements count, does not deallocate */ vma_end_reservation(h, vma, haddr); - if (!(vma->vm_flags & VM_MAYSHARE)) - pagecache_page = hugetlbfs_pagecache_page(h, - vma, haddr); + pagecache_page = hugetlbfs_pagecache_page(h, vma, haddr); } ptl = huge_pte_lock(h, mm, ptep);
Let's add a safety net if we ever get (again) a write-fault on a R/O-mapped page in a shared mapping, in which case we simply have to map the page writable. VM_MAYSHARE handling in hugetlb_fault() for FAULT_FLAG_WRITE indicates that this was at least envisioned, but could never have worked as expected. This theoretically paves the way for softdirty tracking support in hugetlb. Tested without the fix for softdirty tracking. Note that there is no need to do any kind of reservation in hugetlb_fault() in this case ... because we already have a hugetlb page mapped R/O that we will simply map writable and we are not dealing with COW/unsharing. Signed-off-by: David Hildenbrand <david@redhat.com> --- mm/hugetlb.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)