From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EC62C49EA6 for ; Thu, 24 Jun 2021 15:09:47 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 951B86102A for ; Thu, 24 Jun 2021 15:09:46 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 951B86102A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 9A10B6B0036; Thu, 24 Jun 2021 11:09:45 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9775D6B005D; Thu, 24 Jun 2021 11:09:45 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 866B16B006C; Thu, 24 Jun 2021 11:09:45 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0220.hostedemail.com [216.40.44.220]) by kanga.kvack.org (Postfix) with ESMTP id 569216B0036 for ; Thu, 24 Jun 2021 11:09:45 -0400 (EDT) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 7E95A181A871D for ; Thu, 24 Jun 2021 15:09:45 +0000 (UTC) X-FDA: 78288951930.10.204F026 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf01.hostedemail.com (Postfix) with ESMTP id 33724500009A for ; Thu, 24 Jun 2021 15:09:17 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id 66DDD613C3; Thu, 24 Jun 2021 15:09:14 +0000 (UTC) Date: Thu, 24 Jun 2021 16:09:11 +0100 From: Catalin Marinas To: Matthew Wilcox Cc: Christoph Hellwig , Chen Huang , Mark Rutland , Andrew Morton , Stephen Rothwell , Al Viro , Randy Dunlap , Will Deacon , Linux ARM , linux-mm , open list Subject: Re: [BUG] arm64: an infinite loop in generic_perform_write() Message-ID: <20210624150911.GA25097@arm.com> References: <20210623132223.GA96264@C02TD0UTHF1T.local> <1c635945-fb25-8871-7b34-f475f75b2caf@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 33724500009A X-Stat-Signature: t1fdjc6dqc8a3ggur4wxj8txoqz13c95 Authentication-Results: imf01.hostedemail.com; dkim=none; spf=pass (imf01.hostedemail.com: domain of cmarinas@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=cmarinas@kernel.org; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=arm.com (policy=none) X-HE-Tag: 1624547357-296789 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Jun 24, 2021 at 12:15:46PM +0100, Matthew Wilcox wrote: > On Thu, Jun 24, 2021 at 08:04:07AM +0100, Christoph Hellwig wrote: > > On Thu, Jun 24, 2021 at 04:24:46AM +0100, Matthew Wilcox wrote: > > > On Thu, Jun 24, 2021 at 11:10:41AM +0800, Chen Huang wrote: > > > > In userspace, I perform such operation: > > > > > > > > fd = open("/tmp/test", O_RDWR | O_SYNC); > > > > access_address = (char *)mmap(NULL, uio_size, PROT_READ, MAP_SHARED, uio_fd, 0); > > > > ret = write(fd, access_address + 2, sizeof(long)); > > > > > > ... you know that accessing this at unaligned offsets isn't going to > > > work. It's completely meaningless. Why are you trying to do it? > > > > We still should not cause an infinite loop in kernel space due to a > > a userspace programmer error. > > They're running as root and they've mapped some device memory. We can't > save them from themself. Imagine if they'd done this to the NVMe BAR. Ignoring the MMIO case for now, I can trigger the same infinite loop with MTE (memory tagging), something like: char *a; a = mmap(0, page_sz, PROT_READ | PROT_WRITE | PROT_MTE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); /* tag 0 is the default, set tag 1 for the next 16 bytes */ set_tag((unsigned long)(a + 16) | (1UL << 56)); /* uaccess to a[16] expected to fail */ bytes = write(fd, a + 14, 8); The iov_iter_fault_in_readable() check succeeds since a[14] has tag 0. However, the copy_from_user() attempts an unaligned 8-byte load which fails because of the mismatched tag from a[16]. The loop continues indefinitely. copy_from_user() is not required to squeeze in as much as possible. So I think the 1-byte read per page via iov_iter_fault_in_readable() is not sufficient to guarantee progress unless copy_from_user() also reads at least 1 byte. We could change raw_copy_from_user() to fall back to 1-byte read in case of a fault or fix this corner case in the generic code. A quick hack, re-attempting the access with one byte: ------------------8<------------------------- diff --git a/mm/filemap.c b/mm/filemap.c index 66f7e9fdfbc4..67059071460c 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -3686,8 +3686,18 @@ ssize_t generic_perform_write(struct file *file, * because not all segments in the iov can be copied at * once without a pagefault. */ - bytes = min_t(unsigned long, PAGE_SIZE - offset, - iov_iter_single_seg_count(i)); + unsigned long single_seg_bytes = + min_t(unsigned long, PAGE_SIZE - offset, + iov_iter_single_seg_count(i)); + + /* + * Check for intra-page faults (arm64 MTE, SPARC ADI) + * and fall back to single byte. + */ + if (bytes > single_seg_bytes) + bytes = single_seg_bytes; + else + bytes = 1; goto again; } pos += copied; ------------------8<------------------------- Or a slightly different hack, trying to detect if the first segment was crossing a page boundary: ------------------8<------------------------- diff --git a/mm/filemap.c b/mm/filemap.c index 66f7e9fdfbc4..7d1c03f5f559 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -3678,16 +3678,24 @@ ssize_t generic_perform_write(struct file *file, iov_iter_advance(i, copied); if (unlikely(copied == 0)) { + struct iovec v = iov_iter_iovec(i); + /* * If we were unable to copy any data at all, we must - * fall back to a single segment length write. + * fall back to a single segment length write or a + * single byte write (for intra-page faults - arm64 + * MTE or SPARC ADI). * * If we didn't fallback here, we could livelock - * because not all segments in the iov can be copied at - * once without a pagefault. + * because not all segments in the iov or data within + * a segment can be copied at once without a fault. */ - bytes = min_t(unsigned long, PAGE_SIZE - offset, - iov_iter_single_seg_count(i)); + if (((unsigned long)v.iov_base & PAGE_MASK) == + ((unsigned long)(v.iov_base + bytes) & PAGE_MASK)) + bytes = 1; + else + bytes = min_t(unsigned long, PAGE_SIZE - offset, + iov_iter_single_seg_count(i)); goto again; } pos += copied; ------------------8<------------------------- -- Catalin