From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BF48C77B7C for ; Tue, 2 May 2023 01:11:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231915AbjEBBLZ (ORCPT ); Mon, 1 May 2023 21:11:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57432 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229863AbjEBBLV (ORCPT ); Mon, 1 May 2023 21:11:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DAF0311A for ; Mon, 1 May 2023 18:11:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7534A620AC for ; Tue, 2 May 2023 01:11:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BE962C433D2; Tue, 2 May 2023 01:11:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1682989877; bh=ZqmUMLcA1KZyRC/KWQ7IUe6JwcpcVmtv2fEWWRuAQoQ=; h=Date:To:From:Subject:From; b=ELxJgOw26FVUemKYpXusomXouU7+YF/hlK3FtVF8ebMlNihwbS12qocYvmA1qBtzL 3bYclA1aI6Zha2rnJH6i4E+o4Q/H6+7fcd4WBcYd072u2lAc+myl6h8UM3PCWGNgxM MLrYq/C2vECp92fKZQ8hps64+j0s2dshxxpGejaM= Date: Mon, 01 May 2023 18:11:17 -0700 To: mm-commits@vger.kernel.org, willy@infradead.org, tytso@mit.edu, richardcochran@gmail.com, peterz@infradead.org, peterx@redhat.com, pabeni@redhat.com, oleg@redhat.com, neescoba@cisco.com, namhyung@kernel.org, mpenttil@redhat.com, mingo@redhat.com, mark.rutland@arm.com, magnus.karlsson@intel.com, maciej.fijalkowski@intel.com, leon@kernel.org, kuba@kernel.org, kirill@shutemov.name, jonathan.lemon@gmail.com, jolsa@kernel.org, john.fastabend@gmail.com, jhubbard@nvidia.com, jgg@nvidia.com, jack@suse.cz, irogers@google.com, hawk@kernel.org, edumazet@google.com, dennis.dalessandro@cornelisnetworks.com, david@redhat.com, david@fromorbit.com, davem@davemloft.net, daniel@iogearbox.net, brauner@kernel.org, bmt@zurich.ibm.com, bjorn@kernel.org, benve@cisco.com, axboe@kernel.dk, ast@kernel.org, asml.silence@gmail.com, alexander.shishkin@linux.intel.com, adrian.hunter@intel.com, acme@kernel.org, lstoakes@gmail.com, akpm@linux-foundation.org From: Andrew Morton Subject: + mm-gup-disallow-foll_longterm-gup-nonfast-writing-to-file-backed-mappings.patch added to mm-unstable branch Message-Id: <20230502011117.BE962C433D2@smtp.kernel.org> Precedence: bulk Reply-To: linux-kernel@vger.kernel.org List-ID: X-Mailing-List: mm-commits@vger.kernel.org The patch titled Subject: mm/gup: disallow FOLL_LONGTERM GUP-nonfast writing to file-backed mappings has been added to the -mm mm-unstable branch. Its filename is mm-gup-disallow-foll_longterm-gup-nonfast-writing-to-file-backed-mappings.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-gup-disallow-foll_longterm-gup-nonfast-writing-to-file-backed-mappings.patch This patch will later appear in the mm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Lorenzo Stoakes Subject: mm/gup: disallow FOLL_LONGTERM GUP-nonfast writing to file-backed mappings Date: Tue, 2 May 2023 00:11:48 +0100 Writing to file-backed mappings which require folio dirty tracking using GUP is a fundamentally broken operation, as kernel write access to GUP mappings do not adhere to the semantics expected by a file system. A GUP caller uses the direct mapping to access the folio, which does not cause write notify to trigger, nor does it enforce that the caller marks the folio dirty. The problem arises when, after an initial write to the folio, writeback results in the folio being cleaned and then the caller, via the GUP interface, writes to the folio again. As a result of the use of this secondary, direct, mapping to the folio no write notify will occur, and if the caller does mark the folio dirty, this will be done so unexpectedly. For example, consider the following scenario:- 1. A folio is written to via GUP which write-faults the memory, notifying the file system and dirtying the folio. 2. Later, writeback is triggered, resulting in the folio being cleaned and the PTE being marked read-only. 3. The GUP caller writes to the folio, as it is mapped read/write via the direct mapping. 4. The GUP caller, now done with the page, unpins it and sets it dirty (though it does not have to). This results in both data being written to a folio without writenotify, and the folio being dirtied unexpectedly (if the caller decides to do so). This issue was first reported by Jan Kara [1] in 2018, where the problem resulted in file system crashes. This is only relevant when the mappings are file-backed and the underlying file system requires folio dirty tracking. File systems which do not, such as shmem or hugetlb, are not at risk and therefore can be written to without issue. Unfortunately this limitation of GUP has been present for some time and requires future rework of the GUP API in order to provide correct write access to such mappings. However, for the time being we introduce this check to prevent the most egregious case of this occurring, use of the FOLL_LONGTERM pin. These mappings are considerably more likely to be written to after folios are cleaned and thus simply must not be permitted to do so. This patch changes only the slow-path GUP functions, a following patch adapts the GUP-fast path along similar lines. [1]:https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz/ Link: https://lkml.kernel.org/r/ff543d504d2bf83f60b1fb478149b4b3d6298119.1682981880.git.lstoakes@gmail.com Signed-off-by: Lorenzo Stoakes Suggested-by: Jason Gunthorpe Reviewed-by: John Hubbard Reviewed-by: Mika Penttilä Reviewed-by: Jan Kara Reviewed-by: Jason Gunthorpe Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Arnaldo Carvalho de Melo Cc: Bernard Metzler Cc: Björn Töpel Cc: Christian Benvenuti Cc: Christian Brauner Cc: Daniel Borkmann Cc: Dave Chinner Cc: David Hildenbrand Cc: David S. Miller Cc: Dennis Dalessandro Cc: Eric Dumazet Cc: Ian Rogers Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jens Axboe Cc: Jesper Dangaard Brouer Cc: Jiri Olsa Cc: John Fastabend Cc: Jonathan Lemon Cc: "Kirill A. Shutemov" Cc: Leon Romanovsky Cc: Maciej Fijalkowski Cc: Magnus Karlsson Cc: Mark Rutland Cc: Matthew Wilcox (Oracle) Cc: Namhyung Kim Cc: Nelson Escobar Cc: Oleg Nesterov Cc: Paolo Abeni Cc: Pavel Begunkov Cc: Peter Xu Cc: Peter Zijlstra Cc: Richard Cochran Cc: Theodore Ts'o Signed-off-by: Andrew Morton --- mm/gup.c | 41 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) --- a/mm/gup.c~mm-gup-disallow-foll_longterm-gup-nonfast-writing-to-file-backed-mappings +++ a/mm/gup.c @@ -959,16 +959,51 @@ static int faultin_page(struct vm_area_s return 0; } +/* + * Writing to file-backed mappings which require folio dirty tracking using GUP + * is a fundamentally broken operation, as kernel write access to GUP mappings + * do not adhere to the semantics expected by a file system. + * + * Consider the following scenario:- + * + * 1. A folio is written to via GUP which write-faults the memory, notifying + * the file system and dirtying the folio. + * 2. Later, writeback is triggered, resulting in the folio being cleaned and + * the PTE being marked read-only. + * 3. The GUP caller writes to the folio, as it is mapped read/write via the + * direct mapping. + * 4. The GUP caller, now done with the page, unpins it and sets it dirty + * (though it does not have to). + * + * This results in both data being written to a folio without writenotify, and + * the folio being dirtied unexpectedly (if the caller decides to do so). + */ +static bool writeable_file_mapping_allowed(struct vm_area_struct *vma, + unsigned long gup_flags) +{ + /* If we aren't pinning then no problematic write can occur. */ + if (!(gup_flags & (FOLL_GET | FOLL_PIN))) + return true; + + /* We limit this check to the most egregious case - a long term pin. */ + if (!(gup_flags & FOLL_LONGTERM)) + return true; + + /* If the VMA requires dirty tracking then GUP will be problematic. */ + return vma_needs_dirty_tracking(vma); +} + static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) { vm_flags_t vm_flags = vma->vm_flags; int write = (gup_flags & FOLL_WRITE); int foreign = (gup_flags & FOLL_REMOTE); + bool vma_anon = vma_is_anonymous(vma); if (vm_flags & (VM_IO | VM_PFNMAP)) return -EFAULT; - if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) + if ((gup_flags & FOLL_ANON) && !vma_anon) return -EFAULT; if ((gup_flags & FOLL_LONGTERM) && vma_is_fsdax(vma)) @@ -978,6 +1013,10 @@ static int check_vma_flags(struct vm_are return -EFAULT; if (write) { + if (!vma_anon && + !writeable_file_mapping_allowed(vma, gup_flags)) + return -EFAULT; + if (!(vm_flags & VM_WRITE)) { if (!(gup_flags & FOLL_FORCE)) return -EFAULT; _ Patches currently in -mm which might be from lstoakes@gmail.com are mm-mempolicy-correctly-update-prev-when-policy-is-equal-on-mbind.patch mm-mmap-separate-writenotify-and-dirty-tracking-logic.patch mm-gup-disallow-foll_longterm-gup-nonfast-writing-to-file-backed-mappings.patch mm-gup-disallow-foll_longterm-gup-fast-writing-to-file-backed-mappings.patch