From patchwork Fri Oct 30 14:46:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Gunthorpe X-Patchwork-Id: 11869871 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 44E9914B2 for ; Fri, 30 Oct 2020 14:46:30 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C75012075E for ; Fri, 30 Oct 2020 14:46:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=nvidia.com header.i=@nvidia.com header.b="Hw+BaCra" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C75012075E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=nvidia.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D99566B0071; Fri, 30 Oct 2020 10:46:28 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id D485D6B0073; Fri, 30 Oct 2020 10:46:28 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B74A66B0074; Fri, 30 Oct 2020 10:46:28 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0183.hostedemail.com [216.40.44.183]) by kanga.kvack.org (Postfix) with ESMTP id 88B506B0071 for ; Fri, 30 Oct 2020 10:46:28 -0400 (EDT) Received: from smtpin29.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 289621EE6 for ; Fri, 30 Oct 2020 14:46:28 +0000 (UTC) X-FDA: 77428867656.29.spoon33_370d2d927296 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin29.hostedemail.com (Postfix) with ESMTP id 05270180868D3 for ; Fri, 30 Oct 2020 14:46:27 +0000 (UTC) X-Spam-Summary: 1,0,0,,d41d8cd98f00b204,jgg@nvidia.com,,RULES_HIT:30003:30051:30054:30064:30070:30074:30090,0,RBL:216.228.121.64:@nvidia.com:.lbl8.mailshell.net-64.10.201.10 62.18.0.100;04ygaskrtr5mmcei1jyds6qci8wfiopsd4z79zy3a4jfcqi3zfw8g6k5ybxppgt.sf5hs5o3iwc1pc3cnfypqfbih16f7khb8rysj7czjg3xcnoyq98usdind34xb55.g-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:ft,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:68,LUA_SUMMARY:none X-HE-Tag: spoon33_370d2d927296 X-Filterd-Recvd-Size: 9666 Received: from hqnvemgate25.nvidia.com (hqnvemgate25.nvidia.com [216.228.121.64]) by imf32.hostedemail.com (Postfix) with ESMTP for ; Fri, 30 Oct 2020 14:46:26 +0000 (UTC) Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate25.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Fri, 30 Oct 2020 07:46:28 -0700 Received: from HQMAIL111.nvidia.com (172.20.187.18) by HQMAIL101.nvidia.com (172.20.187.10) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 30 Oct 2020 14:46:25 +0000 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (104.47.36.50) by HQMAIL111.nvidia.com (172.20.187.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 30 Oct 2020 14:46:25 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BHccT7vEsawlbEYcmxFpEmRTtRaCTmwalWT7aNqHnFqPBenXxsRiyt8Af29drXg3prkYYIjtGdmkDETSeuZHUAhEK9il4DRP6wX4VhQo8oVU53NOMSpK5u1phsrNJVYzdYWaAw4FJbHXHeRmXXgIDYb0Pjw7EsrLtxG2AQ8FS6Ok0YdQDVBBnqcJL2YJsz1fJnzcdBKejxjEpDqYa0pPoVRWfUtEzfksMLgwM9OgPcDEb4X5r4FVVW25NdQ60CNAi06SBJRNhleWWhU9OSz8Prtm2stCR//SS8B9GEDGJbp6Zn6rZrXfltVDTJ0mgoiNVYhgydmh1cywrnZgcQ17hA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1cPrVOW4yrEyx9eJTI24vwpcxCawqTA4/HeSik+aePY=; b=LBIQlvXMi9shJ+Ewbf2RisNwLKxs4rkTgXeA9PyVdDYTdmG9pT5Or5JljKbQ5gwfJVnEC0Eqz9oKFeDJWtSiQMVeZIoo7QSN8xGGrlKTzm4qO2I352O7khJaSDW8xcI9yVWh5kOulYZfhvzc9Y+0z3SUKFGG0oFjLkAJGvBj5vEbjxzQhXGmzM+evrzYCMhCQ+AUaJGeM1ddPL/bg+Nt8NwzkWGE5JpfDRI0jTgwX11IT4jezEV3uhFN5XTZsYEIQgD1c2rxtjR4f0hXoiZF47SwmVBHTgPzBAAM/h9uxvAUzUHYANX2a0Or64R1dU5nSj+sQzWlc/EbW82JOMVFaQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none Received: from DM6PR12MB3834.namprd12.prod.outlook.com (2603:10b6:5:14a::12) by DM6PR12MB3403.namprd12.prod.outlook.com (2603:10b6:5:11d::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.24; Fri, 30 Oct 2020 14:46:24 +0000 Received: from DM6PR12MB3834.namprd12.prod.outlook.com ([fe80::cdbe:f274:ad65:9a78]) by DM6PR12MB3834.namprd12.prod.outlook.com ([fe80::cdbe:f274:ad65:9a78%7]) with mapi id 15.20.3499.027; Fri, 30 Oct 2020 14:46:24 +0000 From: Jason Gunthorpe To: , Peter Xu , Linus Torvalds CC: Andrea Arcangeli , Andrew Morton , Christoph Hellwig , Hugh Dickins , Jan Kara , Jann Horn , John Hubbard , Kirill Shutemov , Kirill Tkhai , Linux-MM , Michal Hocko , Oleg Nesterov Subject: [PATCH v2 1/2] mm: reorganize internal_get_user_pages_fast() Date: Fri, 30 Oct 2020 11:46:20 -0300 Message-ID: <1-v2-dfe9ecdb6c74+2066-gup_fork_jgg@nvidia.com> In-Reply-To: <0-v2-dfe9ecdb6c74+2066-gup_fork_jgg@nvidia.com> References: X-ClientProxiedBy: BL1PR13CA0270.namprd13.prod.outlook.com (2603:10b6:208:2ba::35) To DM6PR12MB3834.namprd12.prod.outlook.com (2603:10b6:5:14a::12) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from mlx.ziepe.ca (156.34.48.30) by BL1PR13CA0270.namprd13.prod.outlook.com (2603:10b6:208:2ba::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.7 via Frontend Transport; Fri, 30 Oct 2020 14:46:23 +0000 Received: from jgg by mlx with local (Exim 4.94) (envelope-from ) id 1kYVfa-00DEpy-1H; Fri, 30 Oct 2020 11:46:22 -0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1604069188; bh=2hjHbGDaNuupRQ/GjnzPzZ4B4MhwL4BaV/QvhQr7EkI=; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To: CC:Subject:Date:Message-ID:In-Reply-To:References: Content-Transfer-Encoding:Content-Type:X-ClientProxiedBy: MIME-Version:X-MS-Exchange-MessageSentRepresentingType; b=Hw+BaCrahvrDoCs1MSdUhSnvR0ziTaYbFkrGfQ5NwBArLogvSyTXF1UE2a/SUAVBN YZoh9O9PRtqCilShuGTapooB4mptsnHLTgWC65ZqPwxb0YPulx88Hj/NnEN9CWzYZK ksp2irwE5GFnDlAxquBCdJfHyze0lfJ4z9ZU6IsItqWQgj77QWrKsa/wACXnoINnAs IZrvIeHHUE2Psj/y2naD+Iaew8AelQRUZM861ExH4W8kEW2bRgMrT8qagXIY6tApSP z8F3utlqw8hV++0Ym6emO0vKFCeRMsFS2qkYpBNb++YXAuR0Hu+KIw2K/DzR3TZ9D6 ckC4Ak6GThxoQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The next patch in this series makes the lockless flow a little more complex, so move the entire block into a new function and remove a level of indention. Tidy a bit of cruft: - addr is always the same as start, so use start - Use the modern check_add_overflow() for computing end = start + len - nr_pinned/pages << PAGE_SHIFT needs the LHS to be unsigned long to avoid shift overflow, make the variables unsigned long to avoid coding casts in both places. nr_pinned was missing its cast - The handling of ret and nr_pinned can be streamlined a bit No functional change. Signed-off-by: Jason Gunthorpe Reviewed-by: Jan Kara Reviewed-by: John Hubbard Reviewed-by: Peter Xu --- mm/gup.c | 99 ++++++++++++++++++++++++++++++-------------------------- 1 file changed, 54 insertions(+), 45 deletions(-) diff --git a/mm/gup.c b/mm/gup.c index 102877ed77a4b4..150cc962c99201 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -2671,13 +2671,43 @@ static int __gup_longterm_unlocked(unsigned long start, int nr_pages, return ret; } -static int internal_get_user_pages_fast(unsigned long start, int nr_pages, +static unsigned long lockless_pages_from_mm(unsigned long start, + unsigned long end, + unsigned int gup_flags, + struct page **pages) +{ + unsigned long flags; + int nr_pinned = 0; + + if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) || + !gup_fast_permitted(start, end)) + return 0; + + /* + * Disable interrupts. The nested form is used, in order to allow full, + * general purpose use of this routine. + * + * With interrupts disabled, we block page table pages from being freed + * from under us. See struct mmu_table_batch comments in + * include/asm-generic/tlb.h for more details. + * + * We do not adopt an rcu_read_lock() here as we also want to block IPIs + * that come from THPs splitting. + */ + local_irq_save(flags); + gup_pgd_range(start, end, gup_flags, pages, &nr_pinned); + local_irq_restore(flags); + return nr_pinned; +} + +static int internal_get_user_pages_fast(unsigned long start, + unsigned long nr_pages, unsigned int gup_flags, struct page **pages) { - unsigned long addr, len, end; - unsigned long flags; - int nr_pinned = 0, ret = 0; + unsigned long len, end; + unsigned long nr_pinned; + int ret; if (WARN_ON_ONCE(gup_flags & ~(FOLL_WRITE | FOLL_LONGTERM | FOLL_FORCE | FOLL_PIN | FOLL_GET | @@ -2691,54 +2721,33 @@ static int internal_get_user_pages_fast(unsigned long start, int nr_pages, might_lock_read(¤t->mm->mmap_lock); start = untagged_addr(start) & PAGE_MASK; - addr = start; - len = (unsigned long) nr_pages << PAGE_SHIFT; - end = start + len; - - if (end <= start) + len = nr_pages << PAGE_SHIFT; + if (check_add_overflow(start, len, &end)) return 0; if (unlikely(!access_ok((void __user *)start, len))) return -EFAULT; - /* - * Disable interrupts. The nested form is used, in order to allow - * full, general purpose use of this routine. - * - * With interrupts disabled, we block page table pages from being - * freed from under us. See struct mmu_table_batch comments in - * include/asm-generic/tlb.h for more details. - * - * We do not adopt an rcu_read_lock(.) here as we also want to - * block IPIs that come from THPs splitting. - */ - if (IS_ENABLED(CONFIG_HAVE_FAST_GUP) && gup_fast_permitted(start, end)) { - unsigned long fast_flags = gup_flags; - - local_irq_save(flags); - gup_pgd_range(addr, end, fast_flags, pages, &nr_pinned); - local_irq_restore(flags); - ret = nr_pinned; - } + nr_pinned = lockless_pages_from_mm(start, end, gup_flags, pages); + if (nr_pinned == nr_pages || gup_flags & FOLL_FAST_ONLY) + return nr_pinned; - if (nr_pinned < nr_pages && !(gup_flags & FOLL_FAST_ONLY)) { - /* Try to get the remaining pages with get_user_pages */ - start += nr_pinned << PAGE_SHIFT; - pages += nr_pinned; - - ret = __gup_longterm_unlocked(start, nr_pages - nr_pinned, - gup_flags, pages); - - /* Have to be a bit careful with return values */ - if (nr_pinned > 0) { - if (ret < 0) - ret = nr_pinned; - else - ret += nr_pinned; - } + /* Slow path: try to get the remaining pages with get_user_pages */ + start += nr_pinned << PAGE_SHIFT; + pages += nr_pinned; + ret = __gup_longterm_unlocked(start, nr_pages - nr_pinned, gup_flags, + pages); + if (ret < 0) { + /* + * The caller has to unpin the pages we already pinned so + * returning -errno is not an option + */ + if (nr_pinned) + return nr_pinned; + return ret; } - - return ret; + return ret + nr_pinned; } + /** * get_user_pages_fast_only() - pin user pages in memory * @start: starting user address From patchwork Fri Oct 30 14:46:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Gunthorpe X-Patchwork-Id: 11869875 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4C0F014B2 for ; Fri, 30 Oct 2020 14:46:34 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id DBABA20731 for ; Fri, 30 Oct 2020 14:46:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=nvidia.com header.i=@nvidia.com header.b="OTdYVMDo" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DBABA20731 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=nvidia.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 5D0486B0070; Fri, 30 Oct 2020 10:46:29 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 582456B0074; Fri, 30 Oct 2020 10:46:29 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3F9756B0078; Fri, 30 Oct 2020 10:46:29 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0210.hostedemail.com [216.40.44.210]) by kanga.kvack.org (Postfix) with ESMTP id 08D696B0070 for ; Fri, 30 Oct 2020 10:46:28 -0400 (EDT) Received: from smtpin30.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 63C6134A3 for ; Fri, 30 Oct 2020 14:46:28 +0000 (UTC) X-FDA: 77428867656.30.basin57_491859427296 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin30.hostedemail.com (Postfix) with ESMTP id 37345180B3C8E for ; Fri, 30 Oct 2020 14:46:28 +0000 (UTC) X-Spam-Summary: 1,0,0,,d41d8cd98f00b204,jgg@nvidia.com,,RULES_HIT:30054:30064:30070:30090,0,RBL:216.228.121.64:@nvidia.com:.lbl8.mailshell.net-62.18.0.100 64.10.201.10;04yr71ah6opw4cs15jre4kh83wwz1op4e38jhe8phd7msj5emipzfx53mp6aewg.zgoe5abexiz7cshwpekt8mqpwceoccpc3o7iiux6z3kw5cg9bhfsrm4u1atc8yc.1-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:ft,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:658,LUA_SUMMARY:none X-HE-Tag: basin57_491859427296 X-Filterd-Recvd-Size: 12447 Received: from hqnvemgate25.nvidia.com (hqnvemgate25.nvidia.com [216.228.121.64]) by imf12.hostedemail.com (Postfix) with ESMTP for ; Fri, 30 Oct 2020 14:46:26 +0000 (UTC) Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate25.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Fri, 30 Oct 2020 07:46:27 -0700 Received: from HQMAIL111.nvidia.com (172.20.187.18) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 30 Oct 2020 14:46:25 +0000 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (104.47.36.50) by HQMAIL111.nvidia.com (172.20.187.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 30 Oct 2020 14:46:25 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IVUmT12WfetyCvqRIRJ4I5UH8vdbl33KJrcxqWJPu8VioYnOfsBB3fCm+kjCvPJj0F6yX8nCQzfVREPHRAtSrqmvb/bJSv7a/7vdYwL3Tz1aM76t2Hlx9M/x6GxmK/fMEpyVknijs0QWtv0qmtdheXFIPFAZ53rYL0guQsmSMuKTcGG7GzyBNt2LefP7/EqUaRvs7auKXk4pT9j6q4+P28o1mT/Zeidu8IgCFxT5vk/93kN4mzPQ0cFSqy01BuAXUnlWtw8Q4YT1dfbv+nPX6FOeP5GyTuDPR6VW/obYB1zX40HoGWpE/exDkqoZWKM5g31uDMLKg92kRo9HjiR1SA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AyUUsn909gbNlVnQzdbB4MPq+VmC04S0xLiRQ1OKHfY=; b=JhrbQqiTZwI0NVo2MzJoqFT+ZS4iZDEFzvuSnotx2eW51U8Rw+iFDpKe7el3OfgMEdlNt9CEzkEQ9WbaX1saw07YvkIzhwxdRRzCg0HUIhFf/z7UKyd6EU4NzES5UvysDFdEN+0MHmTyO0TSlJgOv2GBs/o65DOpe6Mynwro9ud7h9aSNEYafxLpMtjh5IMvANKmrwTFw4iU5SfbFf7Vjk/VGr6/u/B71N2DlHJN7UXH8sgRvmPku/K+NRcBshJu4i/QhsfIdbFIKdH2xuLtqlkLvnompyhuIjZgBJRa47e6AH+5NsMyi31Auo7OODD+h3NOXyZ/CBRIoG0M1edigw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none Received: from DM6PR12MB3834.namprd12.prod.outlook.com (2603:10b6:5:14a::12) by DM6PR12MB3403.namprd12.prod.outlook.com (2603:10b6:5:11d::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.24; Fri, 30 Oct 2020 14:46:23 +0000 Received: from DM6PR12MB3834.namprd12.prod.outlook.com ([fe80::cdbe:f274:ad65:9a78]) by DM6PR12MB3834.namprd12.prod.outlook.com ([fe80::cdbe:f274:ad65:9a78%7]) with mapi id 15.20.3499.027; Fri, 30 Oct 2020 14:46:23 +0000 From: Jason Gunthorpe To: , Peter Xu , Linus Torvalds CC: Andrea Arcangeli , Andrew Morton , Aneesh Kumar K.V , Christoph Hellwig , Hugh Dickins , Jan Kara , Jann Horn , John Hubbard , Kirill Shutemov , Kirill Tkhai , Leon Romanovsky , Linux-MM , Michal Hocko , Oleg Nesterov Subject: [PATCH v2 2/2] mm: prevent gup_fast from racing with COW during fork Date: Fri, 30 Oct 2020 11:46:21 -0300 Message-ID: <2-v2-dfe9ecdb6c74+2066-gup_fork_jgg@nvidia.com> In-Reply-To: <0-v2-dfe9ecdb6c74+2066-gup_fork_jgg@nvidia.com> References: X-ClientProxiedBy: BL0PR0102CA0056.prod.exchangelabs.com (2603:10b6:208:25::33) To DM6PR12MB3834.namprd12.prod.outlook.com (2603:10b6:5:14a::12) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from mlx.ziepe.ca (156.34.48.30) by BL0PR0102CA0056.prod.exchangelabs.com (2603:10b6:208:25::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.19 via Frontend Transport; Fri, 30 Oct 2020 14:46:23 +0000 Received: from jgg by mlx with local (Exim 4.94) (envelope-from ) id 1kYVfa-00DEq3-3W; Fri, 30 Oct 2020 11:46:22 -0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1604069187; bh=d89KBJlCcce0uUOFM90L9lMb/6UXmKWJc/WASdjPs80=; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To: CC:Subject:Date:Message-ID:In-Reply-To:References: Content-Transfer-Encoding:Content-Type:X-ClientProxiedBy: MIME-Version:X-MS-Exchange-MessageSentRepresentingType; b=OTdYVMDogdxSVuV1TYq9imzmQ9UI4XbTouktIfGwEku5mI3HmV3gZ6Sre5CBNmRLM M0oS5+18V0o2xN6Uxrn7rNXzggFqoXnKOJT39AXzZCzWxR9mFLHsopGzht66RXptwO Sd6L8q5gyRmXpeOtLW0kBOTRtCqNHLsgXn9BX51WbzsmAIMpF2dXR+Djnr70zTKwLy J6C2/9hzBC8zhq2wfwJQK+aQJQsIb+pdMXTx50TL1mTNsy5j37oD6WneWBv5YUaI/L tPXC5FCCxWg3CuAq3BPeGO0SpOk3yUlfqWwfiCfy5mNwIiXIejmL+Fs6WLahLmAP+/ hNPZAHnxZQ35Q== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Since commit 70e806e4e645 ("mm: Do early cow for pinned pages during fork() for ptes") pages under a FOLL_PIN will not be write protected during COW for fork. This means that pages returned from pin_user_pages(FOLL_WRITE) should not become write protected while the pin is active. However, there is a small race where get_user_pages_fast(FOLL_PIN) can establish a FOLL_PIN at the same time copy_present_page() is write protecting it: CPU 0 CPU 1 get_user_pages_fast() internal_get_user_pages_fast() copy_page_range() pte_alloc_map_lock() copy_present_page() atomic_read(has_pinned) == 0 page_maybe_dma_pinned() == false atomic_set(has_pinned, 1); gup_pgd_range() gup_pte_range() pte_t pte = gup_get_pte(ptep) pte_access_permitted(pte) try_grab_compound_head() pte = pte_wrprotect(pte) set_pte_at(); pte_unmap_unlock() // GUP now returns with a write protected page The first attempt to resolve this by using the write protect caused problems (and was missing a barrrier), see commit f3c64eda3e50 ("mm: avoid early COW write protect games during fork()") Instead wrap copy_p4d_range() with the write side of a seqcount and check the read side around gup_pgd_range(). If there is a collision then get_user_pages_fast() fails and falls back to slow GUP. Slow GUP is safe against this race because copy_page_range() is only called while holding the exclusive side of the mmap_lock on the src mm_struct. Fixes: f3c64eda3e50 ("mm: avoid early COW write protect games during fork()") Suggested-by: Linus Torvalds Link: https://lore.kernel.org/r/CAHk-=wi=iCnYCARbPGjkVJu9eyYeZ13N64tZYLdOB8CP5Q_PLw@mail.gmail.com Reviewed-by: John Hubbard Signed-off-by: Jason Gunthorpe Reviewed-by: Jan Kara Reported-by: Jason Gunthorpe Reported-by: John Hubbard Reported-by: Linus Torvalds Signed-off-by: Ahmed S. Darwish Signed-off-by: Ahmed S. Darwish --- arch/x86/kernel/tboot.c | 1 + drivers/firmware/efi/efi.c | 1 + include/linux/mm_types.h | 7 +++++++ kernel/fork.c | 1 + mm/gup.c | 19 +++++++++++++++++++ mm/init-mm.c | 1 + mm/memory.c | 10 +++++++++- 7 files changed, 39 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c index 992fb1415c0f1f..6a2f542d9588a4 100644 --- a/arch/x86/kernel/tboot.c +++ b/arch/x86/kernel/tboot.c @@ -93,6 +93,7 @@ static struct mm_struct tboot_mm = { .pgd = swapper_pg_dir, .mm_users = ATOMIC_INIT(2), .mm_count = ATOMIC_INIT(1), + .write_protect_seq = SEQCNT_ZERO(tboot_mm.write_protect_seq), MMAP_LOCK_INITIALIZER(init_mm) .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), .mmlist = LIST_HEAD_INIT(init_mm.mmlist), diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 5e5480a0a32d7d..2520f6e05f4d44 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -57,6 +57,7 @@ struct mm_struct efi_mm = { .mm_rb = RB_ROOT, .mm_users = ATOMIC_INIT(2), .mm_count = ATOMIC_INIT(1), + .write_protect_seq = SEQCNT_ZERO(efi_mm.write_protect_seq), MMAP_LOCK_INITIALIZER(efi_mm) .page_table_lock = __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock), .mmlist = LIST_HEAD_INIT(efi_mm.mmlist), diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 5a9238f6caad97..f13beacda6fd23 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -14,6 +14,7 @@ #include #include #include +#include #include @@ -446,6 +447,12 @@ struct mm_struct { */ atomic_t has_pinned; + /** + * @write_protect_seq: Odd when any thread is write protecting + * pages in this mm, for instance during fork(). + */ + seqcount_t write_protect_seq; + #ifdef CONFIG_MMU atomic_long_t pgtables_bytes; /* PTE page table pages */ #endif diff --git a/kernel/fork.c b/kernel/fork.c index 32083db7a2a23e..6fd934a6d60d96 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, mm->vmacache_seqnum = 0; atomic_set(&mm->mm_users, 1); atomic_set(&mm->mm_count, 1); + seqcount_init(&mm->write_protect_seq); mmap_init_lock(mm); INIT_LIST_HEAD(&mm->mmlist); mm->core_state = NULL; diff --git a/mm/gup.c b/mm/gup.c index 150cc962c99201..7944749ed7252f 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -2678,11 +2678,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start, { unsigned long flags; int nr_pinned = 0; + unsigned seq; if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) || !gup_fast_permitted(start, end)) return 0; + if (gup_flags & FOLL_PIN) { + seq = raw_read_seqcount(¤t->mm->write_protect_seq); + if (seq & 1) + return 0; + } + /* * Disable interrupts. The nested form is used, in order to allow full, * general purpose use of this routine. @@ -2697,6 +2704,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start, local_irq_save(flags); gup_pgd_range(start, end, gup_flags, pages, &nr_pinned); local_irq_restore(flags); + + /* + * When pinning pages for DMA there could be a concurrent write protect + * from fork() via copy_page_range(), in this case always fail fast GUP. + */ + if (gup_flags & FOLL_PIN) { + if (read_seqcount_t_retry(¤t->mm->write_protect_seq, + seq)) { + unpin_user_pages(pages, nr_pinned); + return 0; + } + } return nr_pinned; } diff --git a/mm/init-mm.c b/mm/init-mm.c index 3a613c85f9ede2..153162669f8062 100644 --- a/mm/init-mm.c +++ b/mm/init-mm.c @@ -31,6 +31,7 @@ struct mm_struct init_mm = { .pgd = swapper_pg_dir, .mm_users = ATOMIC_INIT(2), .mm_count = ATOMIC_INIT(1), + .write_protect_seq = SEQCNT_ZERO(init_mm.write_protect_seq), MMAP_LOCK_INITIALIZER(init_mm) .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), .arg_lock = __SPIN_LOCK_UNLOCKED(init_mm.arg_lock), diff --git a/mm/memory.c b/mm/memory.c index c48f8df6e50268..294c2c3c4fe00d 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1171,6 +1171,12 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE, 0, src_vma, src_mm, addr, end); mmu_notifier_invalidate_range_start(&range); + /* + * The read side doesn't spin, it goes to the mmap_lock, so the + * raw version is used to avoid disabling preemption here + */ + mmap_assert_write_locked(src_mm); + raw_write_seqcount_t_begin(&src_mm->write_protect_seq); } ret = 0; @@ -1187,8 +1193,10 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) } } while (dst_pgd++, src_pgd++, addr = next, addr != end); - if (is_cow) + if (is_cow) { + raw_write_seqcount_t_end(&src_mm->write_protect_seq); mmu_notifier_invalidate_range_end(&range); + } return ret; }