From patchwork Thu Apr 25 17:07:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ryan Roberts X-Patchwork-Id: 13643583 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 725D2C4345F for ; Thu, 25 Apr 2024 17:07:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C7C6F6B0082; Thu, 25 Apr 2024 13:07:37 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C2C8B6B0083; Thu, 25 Apr 2024 13:07:37 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B1B306B0087; Thu, 25 Apr 2024 13:07:37 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 93BCF6B0082 for ; Thu, 25 Apr 2024 13:07:37 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 33C6D1A12D3 for ; Thu, 25 Apr 2024 17:07:37 +0000 (UTC) X-FDA: 82048685754.06.88EDCAC Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by imf22.hostedemail.com (Postfix) with ESMTP id 28E20C0037 for ; Thu, 25 Apr 2024 17:07:15 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=arm.com; spf=pass (imf22.hostedemail.com: domain of ryan.roberts@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=ryan.roberts@arm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1714064836; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references; bh=WjN0m2M7tAiYZQkxReLwIEq9d0viR1o+oJxsNf5ZQhs=; b=maTdjDr3Jjp9UHVV5frMHX1cGQC0TPFyb3gNtHla1LOTRbH/2CaAqi4XzSxyhqc8fjOUSE 7ukJpr++orgQxcSZka2wJICxY65VCPaSnYGbIcU59diT7mOhGTE44kaUkpCRXVlePgHsNU BtGheO4mPfMtD4X4UjTM6eORVuKEpZM= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=arm.com; spf=pass (imf22.hostedemail.com: domain of ryan.roberts@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=ryan.roberts@arm.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1714064836; a=rsa-sha256; cv=none; b=xAW9G/Pqx8lW4QxfqD2NX2PAdKepdDSks4FiLyGLpnbTssCyEG8UYPd6EnN9kMU1Z9QSry vVh+rvP3Z9D9CHoK0w7FI/KDxWUUo3h5AM6IEL/63fP6vJNIqSs998qUhNqq3FgHDDaPyc 4HRWUAneI4cR/GvNuPKqmMtuVqlYQPk= Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 3EC501007; Thu, 25 Apr 2024 10:07:43 -0700 (PDT) Received: from e125769.cambridge.arm.com (e125769.cambridge.arm.com [10.1.196.27]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 1D1813F793; Thu, 25 Apr 2024 10:07:14 -0700 (PDT) From: Ryan Roberts To: Andrew Morton , Zi Yan , "Aneesh Kumar K.V" Cc: Ryan Roberts , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v1] mm: Fix race between __split_huge_pmd_locked() and GUP-fast Date: Thu, 25 Apr 2024 18:07:04 +0100 Message-Id: <20240425170704.3379492-1-ryan.roberts@arm.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 28E20C0037 X-Stat-Signature: ywz679u8teoqjuekmjzffxgioci3da3r X-HE-Tag: 1714064835-79959 X-HE-Meta: U2FsdGVkX1+nsP+aLp+NEjXXb/Ulm3PB38WVITbUEHnIsXxTqVWcLXSz0fueQ9mJWqPpE9+TWFqihNNKXsYlIR08lkwVUHRQM/zhk3OpTa2cWNbvYcWph0b/VrpHixUq89WXuoqcQefL8BxFPzb13BSwJrgRwSuCxuXo/6nSSp/Qpw4tp9f5O6RCqBWcCyeuPqR/8wNDLFTPCLLwoF6coOINVO+D0Ie7tcI7jPy4Tu32CdxiswGuBGD4STKxF+8Ry3lUl3nNIzdJZbPP4RuHhASgseUGTiCPMpH5pCFNNsQikCEuSR20gLPGBY2VSnWAstHS876u+N9KsFnVdvDXkR1ildP0r/yDoR5JpMVUujnJICajaLXw2RzoibEx+X+TbTi4mqQ0seZD+sxW6mJxArN0wOMu+oSxr7hAKuDkMN57o1OCQziNV6TaiG7VXZbMg5A3qywkaZFG5el1obh5pmOr2Z7H41BGGprjxJ4iCBgZ5L1+xfxxJk3MiqJ9M4wfDWvQb6SzKdYQeuKDmz+Sd4JmgnKpwWpdiHve2S/UCwJQaT9rthLBSmX0LQ23ZxaWHsXvMZ0lcCGmC5C4SsckVuyWPxkSpeitssdfQF1q/Stam+XeSj2/b24IY4chHhwh5MpeNyKdiv9LVqnko/5dx9rCXJTqsvSW6Ajqht4kocnp8x51eUOlWeihcOkzNkzQr3xkpzIY/2PbtIvVfWoWghxP2pUg7yEQpfee0P0RV3yW+A5TtdpKfrVOuLLj9PfFGKAHdGXnbtYletHV38vOTTo/Yc9ALfI56A0/YftbB7vRw83bDxRT5TB8JvAdGgiIbsvf7FD2X0Y0MkUIV0LRIKxbzBWBT9LFd0xQYL5J529hu23VW1BzMlxTqNYe0T0eT3jVfAOTmXo= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: __split_huge_pmd_locked() can be called for a present THP, devmap or (non-present) migration entry. It calls pmdp_invalidate() unconditionally on the pmdp and only determines if it is present or not based on the returned old pmd. This is a problem for the migration entry case because pmd_mkinvalid(), called by pmdp_invalidate() must only be called for a present pmd. On arm64 at least, pmd_mkinvalid() will mark the pmd such that any future call to pmd_present() will return true. And therefore any lockless pgtable walker could see the migration entry pmd in this state and start interpretting the fields as if it were present, leading to BadThings (TM). GUP-fast appears to be one such lockless pgtable walker. I suspect the same is possible on other architectures. Fix this by only calling pmdp_invalidate() for a present pmd. And for good measure let's add a warning to the generic implementation of pmdp_invalidate(). I've manually reviewed all other pmdp_invalidate[_ad]() call sites and believe all others to be conformant. This is a theoretical bug found during code review. I don't have any test case to trigger it in practice. Fixes: 84c3fc4e9c56 ("mm: thp: check pmd migration entry in common path") Signed-off-by: Ryan Roberts --- Applies on top of v6.9-rc5. Passes all the mm selftests on arm64. Thanks, Ryan mm/huge_memory.c | 5 +++-- mm/pgtable-generic.c | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) -- 2.25.1 diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 89f58c7603b2..80939ad00718 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2513,12 +2513,12 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, * for this pmd), then we flush the SMP TLB and finally we write the * non-huge version of the pmd entry with pmd_populate. */ - old_pmd = pmdp_invalidate(vma, haddr, pmd); - pmd_migration = is_pmd_migration_entry(old_pmd); + pmd_migration = is_pmd_migration_entry(*pmd); if (unlikely(pmd_migration)) { swp_entry_t entry; + old_pmd = *pmd; entry = pmd_to_swp_entry(old_pmd); page = pfn_swap_entry_to_page(entry); write = is_writable_migration_entry(entry); @@ -2529,6 +2529,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, soft_dirty = pmd_swp_soft_dirty(old_pmd); uffd_wp = pmd_swp_uffd_wp(old_pmd); } else { + old_pmd = pmdp_invalidate(vma, haddr, pmd); page = pmd_page(old_pmd); folio = page_folio(page); if (pmd_dirty(old_pmd)) { diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c index 4fcd959dcc4d..74e34ea90656 100644 --- a/mm/pgtable-generic.c +++ b/mm/pgtable-generic.c @@ -198,6 +198,7 @@ pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp) pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp) { + VM_WARN_ON(!pmd_present(*pmdp)); pmd_t old = pmdp_establish(vma, address, pmdp, pmd_mkinvalid(*pmdp)); flush_pmd_tlb_range(vma, address, address + HPAGE_PMD_SIZE); return old; @@ -208,6 +209,7 @@ pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, pmd_t pmdp_invalidate_ad(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp) { + VM_WARN_ON(!pmd_present(*pmdp)); return pmdp_invalidate(vma, address, pmdp); } #endif