From patchwork Thu Feb 10 12:30:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Muchun Song X-Patchwork-Id: 12741877 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71314C433EF for ; Thu, 10 Feb 2022 12:37:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 107818D0001; Thu, 10 Feb 2022 07:37:50 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 0B6D66B0081; Thu, 10 Feb 2022 07:37:50 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EC12A8D0001; Thu, 10 Feb 2022 07:37:49 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0251.hostedemail.com [216.40.44.251]) by kanga.kvack.org (Postfix) with ESMTP id DD0266B0080 for ; Thu, 10 Feb 2022 07:37:49 -0500 (EST) Received: from smtpin14.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 8A657183BB2BB for ; Thu, 10 Feb 2022 12:37:49 +0000 (UTC) X-FDA: 79126821858.14.81E8853 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) by imf27.hostedemail.com (Postfix) with ESMTP id 33F3740002 for ; Thu, 10 Feb 2022 12:37:49 +0000 (UTC) Received: by mail-pf1-f172.google.com with SMTP id d187so9944898pfa.10 for ; Thu, 10 Feb 2022 04:37:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance-com.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=kGvpK6UTEMeGdDCg9a68QTimGRB3Wg5V4hLO/H8ovOk=; b=8R2KQc0VHwfvgfFLuPp0xcs/i0bFi3ZpoOvzA4bg66nMtTPqQzqxTX+Hj1tWbZt+HU 01u5lq16jDHas70gMpnZO5BBiMuTF+W5pva0r6kivMj+a2RM3QWGQAUXznhUqBxpKPkf Vv/Tu1P5u0Zi/cQioKebx7XyAGlUXUXMibP1SqIBSj3UGsVQaJUelPy5p4+rwTHdnNhy imoRrsXIOlM97bvi9gNvPrSM9JSeP4ZkPvsAYpxNIA9hXjYHh50pMLoZIGcA0ttGpuMA Y/Xsnao5EZKEuqby/5+bnXTVOdcLa1PFjq8mBuhVnryqOZu7iQRstCzev9b3DNb+X1dy uUqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=kGvpK6UTEMeGdDCg9a68QTimGRB3Wg5V4hLO/H8ovOk=; b=BitNn2SRNMbN1iefxDv3cJ2eC5ZEFGHKJnxJEmcnAqUQaaKL/zVaqhKEUNbVQIJHF3 Qvd4stsyTMUWqj9uZZyEo2S0gtqN6DONQVBqQM9opmBdrXJtoEY7h1mvwV1iKByyshNF hRjaY9mmkoHPi/EEe5esCr+i7Lhvmdh705vMhdl2ZxLJ4aI1getoEmKpF7u4f9tYFJ9G hamKFS4Zhn0WFnJrPOZTHuF8WZAtp8hSHRyM4Jw2q08GtQ5/GhD88cNW3NYhwJ//29to 2LA9QWrpDalJtq3jq+eJZ0hbTfcrvVPeRfanjKHsNVLMnoNME8YTdlPAgKM4ErJtYpHI Bujw== X-Gm-Message-State: AOAM531wixQDPVwBOz3Nl7wXMFAyea1ug9kyDcDi6otvRVPcyGLWap0T v6KTxypnOYEJIK/wEU/zhaTHvg== X-Google-Smtp-Source: ABdhPJxuA+mcAk8N3GxFOFt4YcmS2sQMINZgJ8h6aEo3yg4idUSXIkOyJ07Dtpti42YAT/Z5DU8wrQ== X-Received: by 2002:a63:4e0e:: with SMTP id c14mr6120150pgb.490.1644496668324; Thu, 10 Feb 2022 04:37:48 -0800 (PST) Received: from FVFYT0MHHV2J.tiktokcdn.com ([139.177.225.237]) by smtp.gmail.com with ESMTPSA id i8sm11767812pgf.94.2022.02.10.04.37.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Feb 2022 04:37:48 -0800 (PST) From: Muchun Song To: akpm@linux-foundation.org, zi.yan@cs.rutgers.edu, kirill.shutemov@linux.intel.com, rientjes@google.com, lars.persson@axis.com, mike.kravetz@oracle.com, ziy@nvidia.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, duanxiongchun@bytedance.com, fam.zheng@bytedance.com, Muchun Song Subject: [PATCH v5 6/7] mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() Date: Thu, 10 Feb 2022 20:30:57 +0800 Message-Id: <20220210123058.79206-7-songmuchun@bytedance.com> X-Mailer: git-send-email 2.32.0 (Apple Git-132) In-Reply-To: <20220210123058.79206-1-songmuchun@bytedance.com> References: <20220210123058.79206-1-songmuchun@bytedance.com> MIME-Version: 1.0 X-Stat-Signature: fghenxs7fiy6ihs3us6yipjubx4h56xt Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=bytedance-com.20210112.gappssmtp.com header.s=20210112 header.b=8R2KQc0V; spf=pass (imf27.hostedemail.com: domain of songmuchun@bytedance.com designates 209.85.210.172 as permitted sender) smtp.mailfrom=songmuchun@bytedance.com; dmarc=pass (policy=none) header.from=bytedance.com X-Rspam-User: X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 33F3740002 X-HE-Tag: 1644496669-993869 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The userfaultfd calls mcopy_atomic_pte() and __mcopy_atomic() which do not do any cache flushing for the target page. Then the target page will be mapped to the user space with a different address (user address), which might have an alias issue with the kernel address used to copy the data from the user to. Fix this by insert flush_dcache_page() after copy_from_user() succeeds. Fixes: b6ebaedb4cb1 ("userfaultfd: avoid mmap_sem read recursion in mcopy_atomic") Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") Signed-off-by: Muchun Song Reviewed-by: Mike Kravetz --- mm/userfaultfd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 0780c2a57ff1..6ccc534d1c1c 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -150,6 +150,8 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm, /* don't free the page */ goto out; } + + flush_dcache_page(page); } else { page = *pagep; *pagep = NULL; @@ -625,6 +627,7 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm, err = -EFAULT; goto out; } + flush_dcache_page(page); goto retry; } else BUG_ON(page);