* [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan
@ 2024-04-29 11:40 Ryan Roberts
2024-04-29 12:23 ` David Hildenbrand
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Ryan Roberts @ 2024-04-29 11:40 UTC (permalink / raw)
To: Andrew Morton, David Hildenbrand, Muhammad Usama Anjum, Peter Xu
Cc: Ryan Roberts, linux-kernel, linux-fsdevel
make_uffd_wp_pte() was previously doing:
pte = ptep_get(ptep);
ptep_modify_prot_start(ptep);
pte = pte_mkuffd_wp(pte);
ptep_modify_prot_commit(ptep, pte);
But if another thread accessed or dirtied the pte between the first 2
calls, this could lead to loss of that information. Since
ptep_modify_prot_start() gets and clears atomically, the following is
the correct pattern and prevents any possible race. Any access after the
first call would see an invalid pte and cause a fault:
pte = ptep_modify_prot_start(ptep);
pte = pte_mkuffd_wp(pte);
ptep_modify_prot_commit(ptep, pte);
Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
---
fs/proc/task_mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 23fbab954c20..af4bc1da0c01 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1825,7 +1825,7 @@ static void make_uffd_wp_pte(struct vm_area_struct *vma,
pte_t old_pte;
old_pte = ptep_modify_prot_start(vma, addr, pte);
- ptent = pte_mkuffd_wp(ptent);
+ ptent = pte_mkuffd_wp(old_pte);
ptep_modify_prot_commit(vma, addr, pte, old_pte, ptent);
} else if (is_swap_pte(ptent)) {
ptent = pte_swp_mkuffd_wp(ptent);
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan
2024-04-29 11:40 [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan Ryan Roberts
@ 2024-04-29 12:23 ` David Hildenbrand
2024-04-29 13:28 ` Muhammad Usama Anjum
2024-04-29 15:55 ` Ryan Roberts
2 siblings, 0 replies; 5+ messages in thread
From: David Hildenbrand @ 2024-04-29 12:23 UTC (permalink / raw)
To: Ryan Roberts, Andrew Morton, Muhammad Usama Anjum, Peter Xu
Cc: linux-kernel, linux-fsdevel
On 29.04.24 13:40, Ryan Roberts wrote:
> make_uffd_wp_pte() was previously doing:
>
> pte = ptep_get(ptep);
> ptep_modify_prot_start(ptep);
> pte = pte_mkuffd_wp(pte);
> ptep_modify_prot_commit(ptep, pte);
>
> But if another thread accessed or dirtied the pte between the first 2
> calls, this could lead to loss of that information. Since
> ptep_modify_prot_start() gets and clears atomically, the following is
> the correct pattern and prevents any possible race. Any access after the
> first call would see an invalid pte and cause a fault:
>
> pte = ptep_modify_prot_start(ptep);
> pte = pte_mkuffd_wp(pte);
> ptep_modify_prot_commit(ptep, pte);
>
> Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
> ---
> fs/proc/task_mmu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 23fbab954c20..af4bc1da0c01 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -1825,7 +1825,7 @@ static void make_uffd_wp_pte(struct vm_area_struct *vma,
> pte_t old_pte;
>
> old_pte = ptep_modify_prot_start(vma, addr, pte);
> - ptent = pte_mkuffd_wp(ptent);
> + ptent = pte_mkuffd_wp(old_pte);
> ptep_modify_prot_commit(vma, addr, pte, old_pte, ptent);
Acked-by: David Hildenbrand <david@redhat.com>
--
Cheers,
David / dhildenb
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan
2024-04-29 11:40 [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan Ryan Roberts
2024-04-29 12:23 ` David Hildenbrand
@ 2024-04-29 13:28 ` Muhammad Usama Anjum
2024-04-29 15:55 ` Ryan Roberts
2 siblings, 0 replies; 5+ messages in thread
From: Muhammad Usama Anjum @ 2024-04-29 13:28 UTC (permalink / raw)
To: Ryan Roberts, Andrew Morton, David Hildenbrand, Peter Xu
Cc: Muhammad Usama Anjum, linux-kernel, linux-fsdevel
Thanks!
On 4/29/24 4:40 PM, Ryan Roberts wrote:
> make_uffd_wp_pte() was previously doing:
>
> pte = ptep_get(ptep);
> ptep_modify_prot_start(ptep);
> pte = pte_mkuffd_wp(pte);
> ptep_modify_prot_commit(ptep, pte);
>
> But if another thread accessed or dirtied the pte between the first 2
> calls, this could lead to loss of that information. Since
> ptep_modify_prot_start() gets and clears atomically, the following is
> the correct pattern and prevents any possible race. Any access after the
> first call would see an invalid pte and cause a fault:
>
> pte = ptep_modify_prot_start(ptep);
> pte = pte_mkuffd_wp(pte);
> ptep_modify_prot_commit(ptep, pte);
>
> Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
> ---
> fs/proc/task_mmu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 23fbab954c20..af4bc1da0c01 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -1825,7 +1825,7 @@ static void make_uffd_wp_pte(struct vm_area_struct *vma,
> pte_t old_pte;
>
> old_pte = ptep_modify_prot_start(vma, addr, pte);
> - ptent = pte_mkuffd_wp(ptent);
> + ptent = pte_mkuffd_wp(old_pte);
> ptep_modify_prot_commit(vma, addr, pte, old_pte, ptent);
> } else if (is_swap_pte(ptent)) {
> ptent = pte_swp_mkuffd_wp(ptent);
> --
> 2.25.1
>
--
BR,
Muhammad Usama Anjum
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan
2024-04-29 11:40 [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan Ryan Roberts
2024-04-29 12:23 ` David Hildenbrand
2024-04-29 13:28 ` Muhammad Usama Anjum
@ 2024-04-29 15:55 ` Ryan Roberts
2024-04-29 17:23 ` Andrew Morton
2 siblings, 1 reply; 5+ messages in thread
From: Ryan Roberts @ 2024-04-29 15:55 UTC (permalink / raw)
To: Andrew Morton, David Hildenbrand, Muhammad Usama Anjum, Peter Xu
Cc: linux-kernel, linux-fsdevel
On 29/04/2024 12:40, Ryan Roberts wrote:
> make_uffd_wp_pte() was previously doing:
>
> pte = ptep_get(ptep);
> ptep_modify_prot_start(ptep);
> pte = pte_mkuffd_wp(pte);
> ptep_modify_prot_commit(ptep, pte);
>
> But if another thread accessed or dirtied the pte between the first 2
> calls, this could lead to loss of that information. Since
> ptep_modify_prot_start() gets and clears atomically, the following is
> the correct pattern and prevents any possible race. Any access after the
> first call would see an invalid pte and cause a fault:
>
> pte = ptep_modify_prot_start(ptep);
> pte = pte_mkuffd_wp(pte);
> ptep_modify_prot_commit(ptep, pte);
>
> Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
I guess this should have cc'ed stable but I forgot to add it. Are you able to
fix this up when you take it, Andrew, or do I need to repost?
> ---
> fs/proc/task_mmu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 23fbab954c20..af4bc1da0c01 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -1825,7 +1825,7 @@ static void make_uffd_wp_pte(struct vm_area_struct *vma,
> pte_t old_pte;
>
> old_pte = ptep_modify_prot_start(vma, addr, pte);
> - ptent = pte_mkuffd_wp(ptent);
> + ptent = pte_mkuffd_wp(old_pte);
> ptep_modify_prot_commit(vma, addr, pte, old_pte, ptent);
> } else if (is_swap_pte(ptent)) {
> ptent = pte_swp_mkuffd_wp(ptent);
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan
2024-04-29 15:55 ` Ryan Roberts
@ 2024-04-29 17:23 ` Andrew Morton
0 siblings, 0 replies; 5+ messages in thread
From: Andrew Morton @ 2024-04-29 17:23 UTC (permalink / raw)
To: Ryan Roberts
Cc: David Hildenbrand, Muhammad Usama Anjum, Peter Xu, linux-kernel,
linux-fsdevel
On Mon, 29 Apr 2024 16:55:07 +0100 Ryan Roberts <ryan.roberts@arm.com> wrote:
> > Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
> > Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
>
> I guess this should have cc'ed stable but I forgot to add it. Are you able to
> fix this up when you take it, Andrew, or do I need to repost?
I have made that change.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-04-29 17:23 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-29 11:40 [PATCH v1] fs/proc/task_mmu: Fix loss of young/dirty bits during pagemap scan Ryan Roberts
2024-04-29 12:23 ` David Hildenbrand
2024-04-29 13:28 ` Muhammad Usama Anjum
2024-04-29 15:55 ` Ryan Roberts
2024-04-29 17:23 ` Andrew Morton
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).