From patchwork Wed Dec 1 19:37:48 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Catalin Marinas X-Patchwork-Id: 12694388 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5A480C433F5 for ; Wed, 1 Dec 2021 19:39:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=uRYTFeQA67P98fJSX/gVue6oksWBLKcLLoW/rG5hIL0=; b=a9ACCpRqqcakhV CFitOsWxQ3sYOjaVxKFJjaHT1ipjRScxF9Aa1/vGZHce/foVBWRNXy6tqB2kQbrLpvHb7653mNv1l 4iY7XtrcBiEB0k7vqgdsBWfiZMGqmj7UH1QLo5VDU8P7oJbsgRAz5/JpSlimpDvC240ZRqmYh14T2 pRgvXqaH0iyJ6x1h5umqDy+fGlPyzHA5RKhVsgb6dTXXgd8P261oqhB3SpgTAu6Gm0FF6Q4XHpv0c fEE5nC5E3RAR9+nS4HEip003X0phVMFoAefJkZo9U8bvOgIgVFBKJ7RmZEdp2IlxeHHnsAzyD7iU1 bcXHXwCrQn/q0KBGAsFA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1msVQx-009xpk-1J; Wed, 01 Dec 2021 19:38:27 +0000 Received: from ams.source.kernel.org ([145.40.68.75]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1msVQY-009xj1-E6 for linux-arm-kernel@lists.infradead.org; Wed, 01 Dec 2021 19:38:04 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3275DB820F1; Wed, 1 Dec 2021 19:38:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B35D4C53FAD; Wed, 1 Dec 2021 19:37:57 +0000 (UTC) From: Catalin Marinas To: Linus Torvalds , Andreas Gruenbacher Cc: Josef Bacik , David Sterba , Al Viro , Andrew Morton , Will Deacon , Matthew Wilcox , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-btrfs@vger.kernel.org Subject: [PATCH v2 2/4] mm: Probe for sub-page faults in fault_in_*() Date: Wed, 1 Dec 2021 19:37:48 +0000 Message-Id: <20211201193750.2097885-3-catalin.marinas@arm.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211201193750.2097885-1-catalin.marinas@arm.com> References: <20211201193750.2097885-1-catalin.marinas@arm.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211201_113802_776177_AC2CA452 X-CRM114-Status: GOOD ( 21.81 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On hardware with features like arm64 MTE or SPARC ADI, an access fault can be triggered at sub-page granularity. Depending on how the fault_in_*() functions are used, the caller can get into a live-lock by continuously retrying the fault-in on an address different from the one where the uaccess failed. In the majority of cases progress is ensured by the following conditions: 1. copy_{to,from}_user_nofault() guarantees at least one byte access if the user address is not faulting. 2. The fault_in_*() loop is resumed from the next address that could not be accessed by copy_{to,from}_user_nofault(). If the loop iteration is restarted from an earlier point, the loop is repeated with the same conditions and it would live-lock. The same problem exists if the fault_in_*() is attempted on the fault address reported by copy_*_user_nofault() since the latter does not guarantee the maximum possible bytes are written and fault_in_*() will succeed in probing a single byte. Introduce probe_subpage_*() and call them from the corresponding fault_in_*() functions on the requested 'min_size' range. The arch code with sub-page faults will have to implement the specific probing functionality. Signed-off-by: Catalin Marinas --- arch/Kconfig | 7 ++++++ include/linux/uaccess.h | 53 +++++++++++++++++++++++++++++++++++++++++ mm/gup.c | 9 ++++--- 3 files changed, 66 insertions(+), 3 deletions(-) diff --git a/arch/Kconfig b/arch/Kconfig index 26b8ed11639d..02502b3362aa 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -27,6 +27,13 @@ config HAVE_IMA_KEXEC config SET_FS bool +config ARCH_HAS_SUBPAGE_FAULTS + bool + help + Select if the architecture can check permissions at sub-page + granularity (e.g. arm64 MTE). The probe_user_*() functions + must be implemented. + config HOTPLUG_SMT bool diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index ac0394087f7d..04ad214c98cd 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -271,6 +271,59 @@ static inline bool pagefault_disabled(void) */ #define faulthandler_disabled() (pagefault_disabled() || in_atomic()) +#ifndef CONFIG_ARCH_HAS_SUBPAGE_FAULTS + +/** + * probe_subpage_writeable: probe the user range for write faults at sub-page + * granularity (e.g. arm64 MTE) + * @uaddr: start of address range + * @size: size of address range + * + * Returns 0 on success, the number of bytes not probed on fault. + * + * It is expected that the caller checked for the write permission of each + * page in the range either by put_user() or GUP. The architecture port can + * implement a more efficient get_user() probing if the same sub-page faults + * are triggered by either a read or a write. + */ +static inline size_t probe_subpage_writeable(void __user *uaddr, size_t size) +{ + return 0; +} + +/** + * probe_subpage_safe_writeable: probe the user range for write faults at + * sub-page granularity without corrupting the + * existing data + * @uaddr: start of address range + * @size: size of address range + * + * Returns 0 on success, the number of bytes not probed on fault. + * + * It is expected that the caller checked for the write permission of each + * page in the range either by put_user() or GUP. + */ +static inline size_t probe_subpage_safe_writeable(void __user *uaddr, + size_t size) +{ + return 0; +} + +/** + * probe_subpage_readable: probe the user range for read faults at sub-page + * granularity + * @uaddr: start of address range + * @size: size of address range + * + * Returns 0 on success, the number of bytes not probed on fault. + */ +static inline size_t probe_subpage_readable(void __user *uaddr, size_t size) +{ + return 0; +} + +#endif + #ifndef ARCH_HAS_NOCACHE_UACCESS static inline __must_check unsigned long diff --git a/mm/gup.c b/mm/gup.c index baa8240615a4..7fa69b0fb859 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1691,7 +1691,8 @@ size_t fault_in_writeable(char __user *uaddr, size_t size, size_t min_size) out: if (size > uaddr - start) faulted_in = uaddr - start; - if (faulted_in < min_size) + if (faulted_in < min_size || + (min_size && probe_subpage_writeable(start, min_size))) return size; return size - faulted_in; } @@ -1759,7 +1760,8 @@ size_t fault_in_safe_writeable(const char __user *uaddr, size_t size, mmap_read_unlock(mm); if (nstart != end) faulted_in = min_t(size_t, nstart - start, size); - if (faulted_in < min_size) + if (faulted_in < min_size || + (min_size && probe_subpage_safe_writeable(uaddr, min_size))) return size; return size - faulted_in; } @@ -1801,7 +1803,8 @@ size_t fault_in_readable(const char __user *uaddr, size_t size, (void)c; if (size > uaddr - start) faulted_in = uaddr - start; - if (faulted_in < min_size) + if (faulted_in < min_size || + (min_size && probe_subpage_readable(start, min_size))) return size; return size - faulted_in; }