From patchwork Sat Apr 23 10:07:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Catalin Marinas X-Patchwork-Id: 12824452 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BF179C433EF for ; Sat, 23 Apr 2022 10:09:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=lRMdYJpoojvwGVh2bpxS5OuHtcASer+gpq/4r9/G0xI=; b=RQHEPxQKXCKOxO 7oBIBdE/okIhBmwwWVNpwJCLhXIxf2UoGJ52+cxM4u8NxBCVLPj2aCXQmqW+vPIbXLJfkwRT+JGZp +i82w5q2Ch4RwnMqrb7qNXI78PTCEZ2D1z5ohBYqqwMO+HHqjC7/ZwOagVXfwRzHL1b2jfn+sPQk4 Kp37OD2EARtdG2QVwDvwLQ69x01jGqSsYbq1HkpA6JEDe3hznyOkSlVfuUidt0lVfeeSa33KaJd3Q j/T1w5b3DcKsHsqLj9xG5o4I0ZBt0ZAXw4PENt2EJ4+zZKakZ3MqfFYKvrtqaJ12OPI+aN36YE4fh oUNgOLMlCcSp6q3MqG+Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1niCgR-0042MS-AD; Sat, 23 Apr 2022 10:08:07 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1niCgH-0042Ih-Eq for linux-arm-kernel@lists.infradead.org; Sat, 23 Apr 2022 10:07:59 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C493660F0D; Sat, 23 Apr 2022 10:07:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE488C385A5; Sat, 23 Apr 2022 10:07:53 +0000 (UTC) From: Catalin Marinas To: Andrew Morton Cc: Linus Torvalds , Andreas Gruenbacher , Josef Bacik , Al Viro , Chris Mason , David Sterba , Will Deacon , linux-fsdevel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v4 0/3] Avoid live-lock in btrfs fault-in+uaccess loop Date: Sat, 23 Apr 2022 11:07:48 +0100 Message-Id: <20220423100751.1870771-1-catalin.marinas@arm.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220423_030757_601593_F60B527F X-CRM114-Status: GOOD ( 14.74 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi, A minor update from v3 here: https://lore.kernel.org/r/20220406180922.1522433-1-catalin.marinas@arm.com In patch 3/3 I dropped the 'len' local variable, so the btrfs patch simply replaces fault_in_writeable() with fault_in_subpage_writeable() and adds a comment. I kept David's ack as there's no functional change since v3. Andrew, since there was no objection last time around, I'd like this series to land in 5.19. As it touches arch, fs and mm, it should probably go in via the mm tree but I'm also happy to merge the series via arm64. Please let me know if you have any preference. The btrfs search_ioctl() function can potentially live-lock on arm64 with MTE enabled due to a fault_in_writeable() + copy_to_user_nofault() unbounded loop. The uaccess can fault in the middle of a page (MTE tag check fault) even if a prior fault_in_writeable() successfully wrote to the beginning of that page. The btrfs loop always restarts the fault-in loop from the beginning of the user buffer, hence the live-lock. The series introduces fault_in_subpage_writeable() together with the arm64 probing counterpart and the btrfs fix. Thanks. Catalin Marinas (3): mm: Add fault_in_subpage_writeable() to probe at sub-page granularity arm64: Add support for user sub-page fault probing btrfs: Avoid live-lock in search_ioctl() on hardware with sub-page faults arch/Kconfig | 7 +++++++ arch/arm64/Kconfig | 1 + arch/arm64/include/asm/mte.h | 1 + arch/arm64/include/asm/uaccess.h | 15 +++++++++++++++ arch/arm64/kernel/mte.c | 30 ++++++++++++++++++++++++++++++ fs/btrfs/ioctl.c | 7 ++++++- include/linux/pagemap.h | 1 + include/linux/uaccess.h | 22 ++++++++++++++++++++++ mm/gup.c | 29 +++++++++++++++++++++++++++++ 9 files changed, 112 insertions(+), 1 deletion(-) base-commit: b2d229d4ddb17db541098b83524d901257e93845