From patchwork Mon Jun 24 21:03:03 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ajay Kaher X-Patchwork-Id: 11013017 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 81A2076 for ; Mon, 24 Jun 2019 13:02:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 68CEC28852 for ; Mon, 24 Jun 2019 13:02:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5BF2C28BD3; Mon, 24 Jun 2019 13:02:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=2.0 tests=BAYES_00,DATE_IN_FUTURE_06_12, MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 626C528852 for ; Mon, 24 Jun 2019 13:02:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3331B6B0006; Mon, 24 Jun 2019 09:02:43 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 2BD078E0003; Mon, 24 Jun 2019 09:02:43 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 15D148E0002; Mon, 24 Jun 2019 09:02:43 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by kanga.kvack.org (Postfix) with ESMTP id CB8936B0006 for ; Mon, 24 Jun 2019 09:02:42 -0400 (EDT) Received: by mail-pl1-f200.google.com with SMTP id p14so7341074plq.1 for ; Mon, 24 Jun 2019 06:02:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:mime-version; bh=1WhF6WRW29t4JGYTp97LOe92+QWH1u7qXPt6K87cbjI=; b=d2sAhu5G29z79l5fPiazc2ZywjG6Be7f1ldnxaVJ7rRJQiHFzGEcYf/DiP0oSrniCV PrCO1o53vbAnBOAAFhrUCJgIpT0HCSSVuAHw8Ka0MBa8j9R8R3Z/BsH3BblCJ7HlEuKu Y9FCRKV9G6JQxmJoVIt3CrBvYaP/4AcJbiY6A+g9cVGF0Fe3ytpVlkjPckIJXXf3QwOA vUy7+MwsLvIAsraOI0ouvog4WX85mG/6sLtJoZshLExHcgTZMwAvoKDdGfv3SUy2YsXR yAgH83A6Xbg2qnO6X85/dnfePBeWBdJXKV929kK0J8Hghet8/a/D2C+zszks63ToTDII FcDw== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com X-Gm-Message-State: APjAAAXUIxVgzlR7CAHpxIUqoXPpDAqEnSWZ8TCh/0UluwfK4GOKaMY2 AV2vgpxhrb0Vsm624Q5eOrBG8s29toESLLw/01Tu4GctIyg1w8R/JsIkqIT2EpnVTyYisYMCccz 6IZzrsJPLL3hsqDJpx/GQ+ewTxo7Kc630QH4hgXliAnBqJ1VZ3wE1dUpXKAjG+3sjkA== X-Received: by 2002:a63:374a:: with SMTP id g10mr32229505pgn.31.1561381362290; Mon, 24 Jun 2019 06:02:42 -0700 (PDT) X-Google-Smtp-Source: APXvYqxM29heQWpkvGmpaNIxRSmQSAOiL0T91rbxsC+0qAyAY0PzxkzEkIbk/bxA72jPsfKt2qBt X-Received: by 2002:a63:374a:: with SMTP id g10mr32229378pgn.31.1561381361025; Mon, 24 Jun 2019 06:02:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561381361; cv=none; d=google.com; s=arc-20160816; b=rpWsdY73HPOKVERSMB9rDV6phkw06KjvWk7SXHv7/Edkb5pw8Iw9Hki1AVPwk+1fSb XwpCrxU9QtrNdnJ0NpzwQuvqN8O2Wr/Tk5ifRFLpoS9eT8LS7ienckkYjLB27vckU2Kf 8xl1poNMVrnjfgdJhUO0Vdye0T9u4lB2wzOIFWRzsx1Mcsj+BRWOt+91PTy16b5fpKdS q5ypYt63DxghvPa1D+rEVHz/DRKu0Sh6fyDut1EhMn7RigQcLPEkma4Ar/CdNSQ88nVV 1ijiJqiy7u35iDcbRV10lKsDneFsNX/NIVpov/u2XMuNIV01fy6Vzv8u6KQWktLjExPD YJtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:message-id:date:subject:cc:to:from; bh=1WhF6WRW29t4JGYTp97LOe92+QWH1u7qXPt6K87cbjI=; b=tpmFjZLUciJ+rRr8glIAqfWt0fuBo6QQjwXAovkmrpetFIJqb355Qg3ZCSxJ3RkqeL Oj7UqDRoyQhkO4Z1fXrNg5uU3M2bvrb36j0Je/3QnZVGo/GDs0FZZbwmGiILThJLMleL OFTwVXN5EbD5LbnPSzHSedkpRDdtGpCLJ8krngypoQlCuVZ+0vmfrdfRLQjvohEnGxbh PeK+/w5o1xb57D8G4Ycr77FYHrk2bBZYlWofmg2FcZNwGgodKnFxms1n9ry45cX4f/FF hAjllHBMhSVykc80PLcjcbxhk8CkqPFPebPscMvsCWh1h4Wsay/P2Zbzj5sFtZ3+836r /6QQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com Received: from EX13-EDG-OU-002.vmware.com (ex13-edg-ou-002.vmware.com. [208.91.0.190]) by mx.google.com with ESMTPS id 33si5175720pla.44.2019.06.24.06.02.40 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 24 Jun 2019 06:02:41 -0700 (PDT) Received-SPF: pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) client-ip=208.91.0.190; Authentication-Results: mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com Received: from sc9-mailhost3.vmware.com (10.113.161.73) by EX13-EDG-OU-002.vmware.com (10.113.208.156) with Microsoft SMTP Server id 15.0.1156.6; Mon, 24 Jun 2019 06:02:38 -0700 Received: from akaher-lnx-dev.eng.vmware.com (unknown [10.110.19.203]) by sc9-mailhost3.vmware.com (Postfix) with ESMTP id 5A37440C84; Mon, 24 Jun 2019 06:02:33 -0700 (PDT) From: Ajay Kaher To: , , , , , , CC: , , , , , , , , , , , , , , , , , , , , , Linus Torvalds , Greg Kroah-Hartman Subject: [PATCH v4 1/3] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping Date: Tue, 25 Jun 2019 02:33:03 +0530 Message-ID: <1561410186-3919-1-git-send-email-akaher@vmware.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Received-SPF: None (EX13-EDG-OU-002.vmware.com: akaher@vmware.com does not designate permitted sender hosts) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Andrea Arcangeli commit 04f5866e41fb70690e28397487d8bd8eea7d712a upstream. The core dumping code has always run without holding the mmap_sem for writing, despite that is the only way to ensure that the entire vma layout will not change from under it. Only using some signal serialization on the processes belonging to the mm is not nearly enough. This was pointed out earlier. For example in Hugh's post from Jul 2017: https://lkml.kernel.org/r/alpine.LSU.2.11.1707191716030.2055@eggly.anvils "Not strictly relevant here, but a related note: I was very surprised to discover, only quite recently, how handle_mm_fault() may be called without down_read(mmap_sem) - when core dumping. That seems a misguided optimization to me, which would also be nice to correct" In particular because the growsdown and growsup can move the vm_start/vm_end the various loops the core dump does around the vma will not be consistent if page faults can happen concurrently. Pretty much all users calling mmget_not_zero()/get_task_mm() and then taking the mmap_sem had the potential to introduce unexpected side effects in the core dumping code. Adding mmap_sem for writing around the ->core_dump invocation is a viable long term fix, but it requires removing all copy user and page faults and to replace them with get_dump_page() for all binary formats which is not suitable as a short term fix. For the time being this solution manually covers the places that can confuse the core dump either by altering the vma layout or the vma flags while it runs. Once ->core_dump runs under mmap_sem for writing the function mmget_still_valid() can be dropped. Allowing mmap_sem protected sections to run in parallel with the coredump provides some minor parallelism advantage to the swapoff code (which seems to be safe enough by never mangling any vma field and can keep doing swapins in parallel to the core dumping) and to some other corner case. In order to facilitate the backporting I added "Fixes: 86039bd3b4e6" however the side effect of this same race condition in /proc/pid/mem should be reproducible since before 2.6.12-rc2 so I couldn't add any other "Fixes:" because there's no hash beyond the git genesis commit. Because find_extend_vma() is the only location outside of the process context that could modify the "mm" structures under mmap_sem for reading, by adding the mmget_still_valid() check to it, all other cases that take the mmap_sem for reading don't need the new check after mmget_not_zero()/get_task_mm(). The expand_stack() in page fault context also doesn't need the new check, because all tasks under core dumping are frozen. Link: http://lkml.kernel.org/r/20190325224949.11068-1-aarcange@redhat.com Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Andrea Arcangeli Reported-by: Jann Horn Suggested-by: Oleg Nesterov Acked-by: Peter Xu Reviewed-by: Mike Rapoport Reviewed-by: Oleg Nesterov Reviewed-by: Jann Horn Acked-by: Jason Gunthorpe Acked-by: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman [akaher@vmware.com: stable 4.9 backport - handle binder_update_page_range - mhocko@suse.com] Signed-off-by: Ajay Kaher --- drivers/android/binder.c | 6 ++++++ fs/proc/task_mmu.c | 18 ++++++++++++++++++ fs/userfaultfd.c | 9 +++++++++ include/linux/mm.h | 21 +++++++++++++++++++++ mm/mmap.c | 6 +++++- 5 files changed, 59 insertions(+), 1 deletion(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 80499f4..f05ab8f 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -581,6 +581,12 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, if (mm) { down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) { + if (allocate == 0) + goto free_range; + goto err_no_vma; + } + vma = proc->vma; if (vma && mm != proc->vma_vm_mm) { pr_err("%d: vma mm and task mm mismatch\n", diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 5138e78..4b207b1 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -1057,6 +1057,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf, count = -EINTR; goto out_mm; } + /* + * Avoid to modify vma->vm_flags + * without locked ops while the + * coredump reads the vm_flags. + */ + if (!mmget_still_valid(mm)) { + /* + * Silently return "count" + * like if get_task_mm() + * failed. FIXME: should this + * function have returned + * -ESRCH if get_task_mm() + * failed like if + * get_proc_task() fails? + */ + up_write(&mm->mmap_sem); + goto out_mm; + } for (vma = mm->mmap; vma; vma = vma->vm_next) { vma->vm_flags &= ~VM_SOFTDIRTY; vma_set_page_prot(vma); diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 784d667..8bf425a 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -479,6 +479,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file) * taking the mmap_sem for writing. */ down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto skip_mm; prev = NULL; for (vma = mm->mmap; vma; vma = vma->vm_next) { cond_resched(); @@ -501,6 +503,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) vma->vm_flags = new_flags; vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; } +skip_mm: up_write(&mm->mmap_sem); mmput(mm); wakeup: @@ -802,6 +805,9 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; @@ -947,6 +953,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; diff --git a/include/linux/mm.h b/include/linux/mm.h index e3c8d40..c239984 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1189,6 +1189,27 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long address, void unmap_vmas(struct mmu_gather *tlb, struct vm_area_struct *start_vma, unsigned long start, unsigned long end); +/* + * This has to be called after a get_task_mm()/mmget_not_zero() + * followed by taking the mmap_sem for writing before modifying the + * vmas or anything the coredump pretends not to change from under it. + * + * NOTE: find_extend_vma() called from GUP context is the only place + * that can modify the "mm" (notably the vm_start/end) under mmap_sem + * for reading and outside the context of the process, so it is also + * the only case that holds the mmap_sem for reading that must call + * this function. Generally if the mmap_sem is hold for reading + * there's no need of this check after get_task_mm()/mmget_not_zero(). + * + * This function can be obsoleted and the check can be removed, after + * the coredump code will hold the mmap_sem for writing before + * invoking the ->core_dump methods. + */ +static inline bool mmget_still_valid(struct mm_struct *mm) +{ + return likely(!mm->core_state); +} + /** * mm_walk - callbacks for walk_page_range * @pmd_entry: if set, called for each non-empty PMD (3rd-level) entry diff --git a/mm/mmap.c b/mm/mmap.c index 3f2314a..19368fb 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2448,7 +2448,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) vma = find_vma_prev(mm, addr, &prev); if (vma && (vma->vm_start <= addr)) return vma; - if (!prev || expand_stack(prev, addr)) + /* don't alter vm_end if the coredump is running */ + if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr)) return NULL; if (prev->vm_flags & VM_LOCKED) populate_vma_page_range(prev, addr, prev->vm_end, NULL); @@ -2474,6 +2475,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) return vma; if (!(vma->vm_flags & VM_GROWSDOWN)) return NULL; + /* don't alter vm_start if the coredump is running */ + if (!mmget_still_valid(mm)) + return NULL; start = vma->vm_start; if (expand_stack(vma, addr)) return NULL; From patchwork Mon Jun 24 21:03:04 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ajay Kaher X-Patchwork-Id: 11013031 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 93EC9186E for ; Mon, 24 Jun 2019 13:03:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8382E2842E for ; Mon, 24 Jun 2019 13:03:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 775E7287A1; Mon, 24 Jun 2019 13:03:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=2.0 tests=BAYES_00,DATE_IN_FUTURE_06_12, MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=unavailable version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0C4C328779 for ; Mon, 24 Jun 2019 13:03:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B708B6B0007; Mon, 24 Jun 2019 09:02:59 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id AFA048E0003; Mon, 24 Jun 2019 09:02:59 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 972BC8E0002; Mon, 24 Jun 2019 09:02:59 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by kanga.kvack.org (Postfix) with ESMTP id 642146B0007 for ; Mon, 24 Jun 2019 09:02:59 -0400 (EDT) Received: by mail-pg1-f197.google.com with SMTP id d3so9353561pgc.9 for ; Mon, 24 Jun 2019 06:02:59 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references:mime-version; bh=WlB3EgfbNvNkzCBJJCkZdYVxKpEST/NPutqyeaBnRhg=; b=MHIaWdT6V0uOBxxEtH3tdRMiXbFEmCH8SqHVkw/2VMp4PnkrejTwP3kg7IRWAuSPtt zv1NO0EpX+7kIkq/6V4Rmu2NW9SRf+sIITZe7CpQItt5w/zDqO4FwllgkfaIXkV5s/Oa 7SNjwhZGHxlk+l7vPIPIqhkZ/EDZLOI6qwXRgTU4dTEJzTE2PsEyNeUgrAPhOdRrMvsS HYOBsybhznVCHnK+a5Iq17Z5dbe1KjpsZcZyW5Y+vvu3+ORblPHbf+xZYEi++uuZ46Jj MvN12ANBualEisiuIVI6xLMDtazaHoJ2DMfso4gHBl0ZyaNLnBLdDAVeOEovhTOcBmD3 H64A== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com X-Gm-Message-State: APjAAAUYEEGg29qndTU9I5fvgon04Ix2JUyUNNP+l/lkKlE5ivMgng6s i37h+lM4VXdJL5O+eSIkEnhmAYZTJNk2pXSFk7/90mZObo3t6JByXjSGSyEgTngeTdkdoXtF6Yc Xe4eg018TBXo6x6T9R6SOroveQaJeOqNlBHrfoNhl64c0wWwLxxq0LePhrSQtV/+TtA== X-Received: by 2002:a17:90a:d983:: with SMTP id d3mr24322989pjv.88.1561381379097; Mon, 24 Jun 2019 06:02:59 -0700 (PDT) X-Google-Smtp-Source: APXvYqzCgtf6QxHXH6C1HDWDuzpnGBKaj/2bySKu85TqciWW5tkfLlKi4A8KvyZmVNB0oM2jgW5b X-Received: by 2002:a17:90a:d983:: with SMTP id d3mr24322906pjv.88.1561381378408; Mon, 24 Jun 2019 06:02:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561381378; cv=none; d=google.com; s=arc-20160816; b=U47sRwdmd5nUnpK8PNtGlcAvf8sX7jAAC+DzcvWUGJDjYrFatOZf3gF/ncYnh7EU/0 xaFV/nnAOFJK+OjXiPUp/vY5VaQ3sj7lAMAaVSGLCYUKNsDhUx3p3zL1IpQEBN1pwaBL U3pUhTx77l/AJryVuEKlNPQxeEZ7z00JDg5770yNqq6pt36DJaIfxrYMIrHvnJryJm2k DXl5y65GYVfF8EScFCQUlpUGm9LuKTkf1o5SRyn5mYMeHTkfV+Wog9uTjmZ0kGUz4GpO 51g09U0kAThQMjt9PV8FrXOcSsdbJl5gRipHx9tByGOTIyHoos7SgEidLx54iiDW46z0 oq3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=WlB3EgfbNvNkzCBJJCkZdYVxKpEST/NPutqyeaBnRhg=; b=wMFp98DTOTQLAUQl2WL3x6BjHyAyBGDjergq0dan3tCi/RRcuPUAF5f7v4vAOg57TK UwUmUmV/sTClHV+9Wlem+px42s7/A48zA6GVQWtSsXCD5xPFlOSIGg3hCYw0Dnuz4Kak ugmuuwiMdjFjRTaXtkaoaPHjsXv9eeGfUuy5BvDS610PVc1Vv1G4OBYPoE7PXB/lJOY/ eCaLeX684rczNBvKHASapwvuUFMkbe0RCveHqqNHQyqcqGEPKGuf6rcAigtY0G4Tys1s wa80anXGoVwQTavtZlYm2pAVSo3UIF5ZnJ4QRRpLEIpmpwKTzrOhB36xy65ptdRzqDPS G/ew== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com Received: from EX13-EDG-OU-002.vmware.com (ex13-edg-ou-002.vmware.com. [208.91.0.190]) by mx.google.com with ESMTPS id v7si11880352pfb.132.2019.06.24.06.02.58 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 24 Jun 2019 06:02:58 -0700 (PDT) Received-SPF: pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) client-ip=208.91.0.190; Authentication-Results: mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com Received: from sc9-mailhost3.vmware.com (10.113.161.73) by EX13-EDG-OU-002.vmware.com (10.113.208.156) with Microsoft SMTP Server id 15.0.1156.6; Mon, 24 Jun 2019 06:02:56 -0700 Received: from akaher-lnx-dev.eng.vmware.com (unknown [10.110.19.203]) by sc9-mailhost3.vmware.com (Postfix) with ESMTP id 8452E412C5; Mon, 24 Jun 2019 06:02:51 -0700 (PDT) From: Ajay Kaher To: , , , , , , CC: , , , , , , , , , , , , , , , , , , , , Subject: [PATCH v4 2/3][v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping Date: Tue, 25 Jun 2019 02:33:04 +0530 Message-ID: <1561410186-3919-2-git-send-email-akaher@vmware.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1561410186-3919-1-git-send-email-akaher@vmware.com> References: <1561410186-3919-1-git-send-email-akaher@vmware.com> MIME-Version: 1.0 Received-SPF: None (EX13-EDG-OU-002.vmware.com: akaher@vmware.com does not designate permitted sender hosts) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This patch is the extension of following upstream commit to fix the race condition between get_task_mm() and core dumping for IB->mlx4 and IB->mlx5 drivers: commit 04f5866e41fb ("coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping")' Thanks to Jason for pointing this. Signed-off-by: Ajay Kaher Reviewed-by: Jason Gunthorpe --- drivers/infiniband/hw/mlx4/main.c | 4 +++- drivers/infiniband/hw/mlx5/main.c | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c index 8d59a59..7ccf722 100644 --- a/drivers/infiniband/hw/mlx4/main.c +++ b/drivers/infiniband/hw/mlx4/main.c @@ -1172,6 +1172,8 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) * mlx4_ib_vma_close(). */ down_write(&owning_mm->mmap_sem); + if (!mmget_still_valid(owning_mm)) + goto skip_mm; for (i = 0; i < HW_BAR_COUNT; i++) { vma = context->hw_bar_info[i].vma; if (!vma) @@ -1190,7 +1192,7 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) /* context going to be destroyed, should not access ops any more */ context->hw_bar_info[i].vma->vm_ops = NULL; } - +skip_mm: up_write(&owning_mm->mmap_sem); mmput(owning_mm); put_task_struct(owning_process); diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index b1daf5c..f94df0e 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -1307,6 +1307,8 @@ static void mlx5_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) * mlx5_ib_vma_close. */ down_write(&owning_mm->mmap_sem); + if (!mmget_still_valid(owning_mm)) + goto skip_mm; list_for_each_entry_safe(vma_private, n, &context->vma_private_list, list) { vma = vma_private->vma; @@ -1321,6 +1323,7 @@ static void mlx5_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) list_del(&vma_private->list); kfree(vma_private); } +skip_mm: up_write(&owning_mm->mmap_sem); mmput(owning_mm); put_task_struct(owning_process); From patchwork Mon Jun 24 21:03:05 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ajay Kaher X-Patchwork-Id: 11013041 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 548A276 for ; Mon, 24 Jun 2019 13:03:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 46839287BE for ; Mon, 24 Jun 2019 13:03:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 392E328BB8; Mon, 24 Jun 2019 13:03:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=2.0 tests=BAYES_00,DATE_IN_FUTURE_06_12, MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=unavailable version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8D1CA287BE for ; Mon, 24 Jun 2019 13:03:13 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 94CC36B0008; Mon, 24 Jun 2019 09:03:12 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 8D7F48E0003; Mon, 24 Jun 2019 09:03:12 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 776EA8E0002; Mon, 24 Jun 2019 09:03:12 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by kanga.kvack.org (Postfix) with ESMTP id 3BBD76B0008 for ; Mon, 24 Jun 2019 09:03:12 -0400 (EDT) Received: by mail-pl1-f199.google.com with SMTP id q11so940921pll.22 for ; Mon, 24 Jun 2019 06:03:12 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references:mime-version; bh=m2ABSez10NsjyZLoNHNYp82v2fZDDIVB7Dh3Iq8opcs=; b=YiqIU3/7QtbHjDJTjYVcAD4JHTVc1gtFlo6DMpcKo7buqQkautCht+MelT/kY2y7lt LSxquJWmeE/9mC19JeASSAuMgGyLfeFlmOgsNwNvqLCEc+lpudrmE6/7i7o5Pksbo955 tZOa8nsFARFIXSNbx+ycnrN4jKnTF0aOXP0qJorZiciq7Fgjhw5q5vrPVo55iaIy3TpH FtUOG/unDOkjSIxS6xmPGMO+OuGO+yDSmWQJNzhQO/nHxxiII7pXAdSDOA+UDnKpPHos j9zlPQdCBa5sYnC0cV8EIXdGhNLLBt5EggIqGyJbFt8SiNCZBjj2tgT7/cUT5t8Wv737 LM2w== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com X-Gm-Message-State: APjAAAXg17SCDR6NIoiK/AyjKRRDMEFTg20hYjT/C2cY5rUXecQLZ6xi kKqT3Pa3uAZCVGUCBbSgID8sAviboDX9T74U3/UCVIhiEi/yFUmuH3KN+v9nOXdB62Jctp6zU9B ivj+KOwR9lgtiAlOcqGfnwEeirMngk2lbhSEUXBnWpfzDSwi+o8ETx2KyAnOtl/Fw4w== X-Received: by 2002:a17:90a:32ed:: with SMTP id l100mr24476944pjb.11.1561381391896; Mon, 24 Jun 2019 06:03:11 -0700 (PDT) X-Google-Smtp-Source: APXvYqzkZ83MbCv+guwXnpfBN+orGPgPaoXeiAs8NUGpU54HAktoGolngWJrDhMX4+eBgQJjUTvF X-Received: by 2002:a17:90a:32ed:: with SMTP id l100mr24476870pjb.11.1561381391170; Mon, 24 Jun 2019 06:03:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561381391; cv=none; d=google.com; s=arc-20160816; b=D68WZ9xCvr8OL+5TTFnNwE6+KHUZ+pTJCiz2T8sGDByncPTYSFBk7nUMuCaaCs3F2l 4XVxx0fGSZwczmE0J/MHrPzO+EQ83JuPhrBPMDDSEKg1NPtktvy9N4wVZBLanU7rpN8m XmbCtkJtl3zmhOg7p7RX0Wln/WUsJpK7MdYDPdEOvhRfxFLCiMF641oyBDYFXti6VA0m 0Cgyc8eDBKJau38vPRnNi508NAjw5l1T7n9BZcA8CdzhJjljByXundnmGXIp6qMyRKQe QY09UJZOJ7YGZ5hNYcJCkKsaIa8k1RObBayXBEWbcxbps5fiGGFUMAG+pThNEWTYTgEG aYWw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=m2ABSez10NsjyZLoNHNYp82v2fZDDIVB7Dh3Iq8opcs=; b=Nb4FHC53o6ojq0cMkkRKWLDvmzqYKitXwe+/RbMkpHzLI1Nmz6TkcAi5JTN0G7Vm00 nbb6Dn/gZ11UlPo2HRnaSgNOAt5P5yGzhxI2E+CfKzhePDd1JN48LGrxfZSGw3GX385o FUC5KnaPVy8D0MK5NNjo2069GZ97UWXltCj6XlzJnYYiCib9hNoFO1O5gGa1qZ/EAVHI 7XLrqN1vKEOqXalMvQOMTc0D5f/SWa1lawHddQAskdX97fFl1z7wGRBHWwysPCXkbt5K jeX2s7zMgfPO2VTBWdRUfofAtsIU8nAgCIwOGYd/B1Yfell8/gGTTYmdMl/NmzqtmTEy FyAA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com Received: from EX13-EDG-OU-002.vmware.com (ex13-edg-ou-002.vmware.com. [208.91.0.190]) by mx.google.com with ESMTPS id v19si9941240plo.404.2019.06.24.06.03.11 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 24 Jun 2019 06:03:11 -0700 (PDT) Received-SPF: pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) client-ip=208.91.0.190; Authentication-Results: mx.google.com; spf=pass (google.com: domain of akaher@vmware.com designates 208.91.0.190 as permitted sender) smtp.mailfrom=akaher@vmware.com; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=vmware.com Received: from sc9-mailhost3.vmware.com (10.113.161.73) by EX13-EDG-OU-002.vmware.com (10.113.208.156) with Microsoft SMTP Server id 15.0.1156.6; Mon, 24 Jun 2019 06:03:08 -0700 Received: from akaher-lnx-dev.eng.vmware.com (unknown [10.110.19.203]) by sc9-mailhost3.vmware.com (Postfix) with ESMTP id 69A894135D; Mon, 24 Jun 2019 06:03:03 -0700 (PDT) From: Ajay Kaher To: , , , , , , CC: , , , , , , , , , , , , , , , , , , , , , Hugh Dickins , Mike Rapoport , Linus Torvalds , Greg Kroah-Hartman Subject: [PATCH v4 3/3] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping Date: Tue, 25 Jun 2019 02:33:05 +0530 Message-ID: <1561410186-3919-3-git-send-email-akaher@vmware.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1561410186-3919-1-git-send-email-akaher@vmware.com> References: <1561410186-3919-1-git-send-email-akaher@vmware.com> MIME-Version: 1.0 Received-SPF: None (EX13-EDG-OU-002.vmware.com: akaher@vmware.com does not designate permitted sender hosts) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Andrea Arcangeli coredump: fix race condition between collapse_huge_page() and core dumping commit 59ea6d06cfa9247b586a695c21f94afa7183af74 upstream. When fixing the race conditions between the coredump and the mmap_sem holders outside the context of the process, we focused on mmget_not_zero()/get_task_mm() callers in 04f5866e41fb70 ("coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping"), but those aren't the only cases where the mmap_sem can be taken outside of the context of the process as Michal Hocko noticed while backporting that commit to older -stable kernels. If mmgrab() is called in the context of the process, but then the mm_count reference is transferred outside the context of the process, that can also be a problem if the mmap_sem has to be taken for writing through that mm_count reference. khugepaged registration calls mmgrab() in the context of the process, but the mmap_sem for writing is taken later in the context of the khugepaged kernel thread. collapse_huge_page() after taking the mmap_sem for writing doesn't modify any vma, so it's not obvious that it could cause a problem to the coredump, but it happens to modify the pmd in a way that breaks an invariant that pmd_trans_huge_lock() relies upon. collapse_huge_page() needs the mmap_sem for writing just to block concurrent page faults that call pmd_trans_huge_lock(). Specifically the invariant that "!pmd_trans_huge()" cannot become a "pmd_trans_huge()" doesn't hold while collapse_huge_page() runs. The coredump will call __get_user_pages() without mmap_sem for reading, which eventually can invoke a lockless page fault which will need a functional pmd_trans_huge_lock(). So collapse_huge_page() needs to use mmget_still_valid() to check it's not running concurrently with the coredump... as long as the coredump can invoke page faults without holding the mmap_sem for reading. This has "Fixes: khugepaged" to facilitate backporting, but in my view it's more a bug in the coredump code that will eventually have to be rewritten to stop invoking page faults without the mmap_sem for reading. So the long term plan is still to drop all mmget_still_valid(). Link: http://lkml.kernel.org/r/20190607161558.32104-1-aarcange@redhat.com Fixes: ba76149f47d8 ("thp: khugepaged") Signed-off-by: Andrea Arcangeli Reported-by: Michal Hocko Acked-by: Michal Hocko Acked-by: Kirill A. Shutemov Cc: Oleg Nesterov Cc: Jann Horn Cc: Hugh Dickins Cc: Mike Rapoport Cc: Mike Kravetz Cc: Peter Xu Cc: Jason Gunthorpe Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman [Ajay: Just adjusted to apply on v4.9] Signed-off-by: Ajay Kaher --- include/linux/mm.h | 4 ++++ mm/khugepaged.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index c239984..8852158 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1194,6 +1194,10 @@ void unmap_vmas(struct mmu_gather *tlb, struct vm_area_struct *start_vma, * followed by taking the mmap_sem for writing before modifying the * vmas or anything the coredump pretends not to change from under it. * + * It also has to be called when mmgrab() is used in the context of + * the process, but then the mm_count refcount is transferred outside + * the context of the process to run down_write() on that pinned mm. + * * NOTE: find_extend_vma() called from GUP context is the only place * that can modify the "mm" (notably the vm_start/end) under mmap_sem * for reading and outside the context of the process, so it is also diff --git a/mm/khugepaged.c b/mm/khugepaged.c index e0cfc3a..8217ee5 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1004,6 +1004,9 @@ static void collapse_huge_page(struct mm_struct *mm, * handled by the anon_vma lock + PG_lock. */ down_write(&mm->mmap_sem); + result = SCAN_ANY_PROCESS; + if (!mmget_still_valid(mm)) + goto out; result = hugepage_vma_revalidate(mm, address, &vma); if (result) goto out;