linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/3] userfaultfd non-cooperative further update for 4.11 merge window
@ 2017-02-24 18:19 Andrea Arcangeli
  2017-02-24 18:19 ` [PATCH 1/3] userfaultfd: non-cooperative: rollback userfaultfd_exit Andrea Arcangeli
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Andrea Arcangeli @ 2017-02-24 18:19 UTC (permalink / raw)
  To: linux-mm, Andrew Morton
  Cc: Michael Rapoport, Dr. David Alan Gilbert, Mike Kravetz,
	Pavel Emelyanov, Hillf Danton

Hello,

unfortunately I noticed one relevant bug in userfaultfd_exit while
doing more testing. I've been doing testing before and this was also
tested by kbuild bot and exercised by the selftest, but this bug never
reproduced before.

I dropped userfaultfd_exit as result. I dropped it because of
implementation difficulty in receiving signals in __mmput and because
I think -ENOSPC as result from the background UFFDIO_COPY should be
enough already.

Before I decided to remove userfaultfd_exit, I noticed
userfaultfd_exit wasn't exercised by the selftest and when I tried to
exercise it, after moving it to a more correct place in __mmput where
it would make more sense and where the vma list is stable, it resulted
in the event_wait_completion in D state. So then I added the second
patch to be sure even if we call userfaultfd_event_wait_completion too
late during task exit(), we won't risk to generate tasks in D
state. The same check exists in handle_userfault() for the same
reason, except it makes a difference there, while here is just a
robustness check and it's run under WARN_ON_ONCE.

While looking at the userfaultfd_event_wait_completion() function I
looked back at its callers too while at it and I think it's not ok to
stop executing dup_fctx on the fcs list because we relay on
userfaultfd_event_wait_completion to execute
userfaultfd_ctx_put(fctx->orig) which is paired against
userfaultfd_ctx_get(fctx->orig) in dup_userfault just before
list_add(fcs). This change only takes care of fctx->orig but this area
also needs further review looking for similar problems in fctx->new.

The only patch that is urgent is the first because it's an use after
free during a SMP race condition that affects all processes if
CONFIG_USERFAULTFD=y. Very hard to reproduce though and probably
impossible without SLUB poisoning enabled.

Mike and Pavel please review, thanks!
Andrea

Andrea Arcangeli (3):
  userfaultfd: non-cooperative: rollback userfaultfd_exit
  userfaultfd: non-cooperative: robustness check
  userfaultfd: non-cooperative: release all ctx in
    dup_userfaultfd_complete

 fs/userfaultfd.c                 | 47 +++++++---------------------------------
 include/linux/userfaultfd_k.h    |  6 -----
 include/uapi/linux/userfaultfd.h |  5 +----
 kernel/exit.c                    |  1 -
 4 files changed, 9 insertions(+), 50 deletions(-)

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-03-01  5:17 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-24 18:19 [PATCH 0/3] userfaultfd non-cooperative further update for 4.11 merge window Andrea Arcangeli
2017-02-24 18:19 ` [PATCH 1/3] userfaultfd: non-cooperative: rollback userfaultfd_exit Andrea Arcangeli
2017-02-24 18:19 ` [PATCH 2/3] userfaultfd: non-cooperative: robustness check Andrea Arcangeli
2017-02-24 18:19 ` [PATCH 3/3] userfaultfd: non-cooperative: release all ctx in dup_userfaultfd_complete Andrea Arcangeli
2017-02-28  7:15 ` [PATCH 0/3] userfaultfd non-cooperative further update for 4.11 merge window Mike Rapoport
2017-03-01  5:17 ` [PATCH 1.5/3] userfaultfd: documentation fixup after removal of UFFD_EVENT_EXIT Mike Rapoport

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).