From patchwork Tue May 9 14:42:48 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 98937 Delivered-To: patch@linaro.org Received: by 10.140.96.100 with SMTP id j91csp1857734qge; Tue, 9 May 2017 07:43:54 -0700 (PDT) X-Received: by 10.99.114.3 with SMTP id n3mr554917pgc.130.1494341034332; Tue, 09 May 2017 07:43:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1494341034; cv=none; d=google.com; s=arc-20160816; b=tDg0vK7BhQk7vHxiVKlopplgynaMaTv05cmho9LA9eyOuzMnFVefD+nUhTnFlZpW88 3SpGhAVkDCMuv2Fu90xW0EVrEbNUMT4AA8lO19PcUMResUUyDllka58BqkoctPFRCeNy NkIIjx0j6VAKblqpYCHibw8j5Y4CPBqODMXA9rchmlUTWBvNjgF11TtQbUyRPbxId/Av fx3J0xHEarYbxTdv09cFzMla7kgSoo/N/k79SCTvs8kpg4NcjwWg8cC1KA2Rk9KvedfE t76NTPVUWDeaxvMokdOOPdfXFB/75dhGbkbg3r6yRlZ/QatEG+sEpJ0qLtlqQGFQgzY4 uEvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=CkEvAodoAtUvpC3VRUnObqTv0V55oEcBEjuehes/7Jg=; b=0kITNOfAeAjwD0QEXiKBCt3KB3eThEZP3jlDrcBkTZs+MABVxZRGjPUadrwBPrlwkZ iiui+6S93ZTt059HqD3G8nG7bLpiPpagmVvO7yDOQjTKWro6atAD+nohsBBXCZxW5PIt x2zot7cBdwQw5owaJATRD3sBLhAw1xCCBtuBuQ9w0Iqo+yteBJ96qO5LKBNqZkTBbdDF 2GyCd1+W/ZktDjVBLybGSJuovck3icrUcMR5Px9bwel86DgQib7+6dA31xDebJ/9G9N/ Qva8tnGt735Ow3TFMpkmv6PT+hUc+0FKeeLAenXcBMcSaobxRilZMOHBcNJfYB9SLmvq wAWw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h2si99892pli.322.2017.05.09.07.43.54; Tue, 09 May 2017 07:43:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754308AbdEIOnx (ORCPT + 6 others); Tue, 9 May 2017 10:43:53 -0400 Received: from mail-pg0-f46.google.com ([74.125.83.46]:33364 "EHLO mail-pg0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754280AbdEIOnw (ORCPT ); Tue, 9 May 2017 10:43:52 -0400 Received: by mail-pg0-f46.google.com with SMTP id u187so792917pgb.0 for ; Tue, 09 May 2017 07:43:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=CkEvAodoAtUvpC3VRUnObqTv0V55oEcBEjuehes/7Jg=; b=JY+xBHist2dzNe9bhc+Ca/ubFgoM94GYFitILL7Ua4ZCFicYRT+SkL/dVbzmYYSVDE tZS+AX6QK3wKAMMK0z0luIyg7lxr8FVB5mlqQKASF3pE/A5cuvgzIbddL39sgSdCdYWz m9Gkz4WqxuJKSKyRhHY5nX5oeJ1C/e1ocAIlA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=CkEvAodoAtUvpC3VRUnObqTv0V55oEcBEjuehes/7Jg=; b=mKRaFIlZc4xVK0/b3rkSqoYWk/RB5JQ0jSLWaJtQCH/4oE3Ezc7LLdYzP+49gxtb+C 0h5I4ACY8pXb91PSaOge7qpyFj4NgOLZGjpIjYK8v8dQWQH4VWlxFisrnAGqa5ZLpKQE zfoe7UuaJUd6GCCVXd3U2tVU5y37OLuqw9078pyodyoHJHlilViVahKIVY3y1nwBYpEp 7xZtFw0VbIYwWDjZrYN9I5fw4XVcI/f5yRuDhC0kLqlCxmkSHQUvpiHxP1BUNG7ZARnf oqo7Axg1vyJSRw0t7f6ob7yZNpWWGmyFWe6wZ9q8yqFsesxIm7ERzbfPGNJDQDbuklaD 8MDA== X-Gm-Message-State: AODbwcBnQb5JXuUTYH1NizUqQRode1+mM9SJDItWojcqzBvSX9hGI5f0 WymJEepuWHD0EzYu X-Received: by 10.84.238.9 with SMTP id u9mr689530plk.126.1494341032176; Tue, 09 May 2017 07:43:52 -0700 (PDT) Received: from localhost.localdomain ([106.51.135.126]) by smtp.gmail.com with ESMTPSA id 11sm341811pfj.59.2017.05.09.07.43.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 09 May 2017 07:43:51 -0700 (PDT) From: Amit Pundir To: Greg KH Cc: stable@vger.kernel.org, Keno Fischer , Greg Thelen , Nicholas Piggin , Willy Tarreau , Oleg Nesterov , Kees Cook , Andy Lutomirski , Michal Hocko , Hugh Dickins , Andrew Morton , Linus Torvalds Subject: [PATCH for-3.18 24/24] mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp Date: Tue, 9 May 2017 20:12:48 +0530 Message-Id: <1494340968-17152-25-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1494340968-17152-1-git-send-email-amit.pundir@linaro.org> References: <1494340968-17152-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Keno Fischer commit 8310d48b125d19fcd9521d83b8293e63eb1646aa upstream. In commit 19be0eaffa3a ("mm: remove gup_flags FOLL_WRITE games from __get_user_pages()"), the mm code was changed from unsetting FOLL_WRITE after a COW was resolved to setting the (newly introduced) FOLL_COW instead. Simultaneously, the check in gup.c was updated to still allow writes with FOLL_FORCE set if FOLL_COW had also been set. However, a similar check in huge_memory.c was forgotten. As a result, remote memory writes to ro regions of memory backed by transparent huge pages cause an infinite loop in the kernel (handle_mm_fault sets FOLL_COW and returns 0 causing a retry, but follow_trans_huge_pmd bails out immidiately because `(flags & FOLL_WRITE) && !pmd_write(*pmd)` is true. While in this state the process is stil SIGKILLable, but little else works (e.g. no ptrace attach, no other signals). This is easily reproduced with the following code (assuming thp are set to always): #include #include #include #include #include #include #include #include #include #include #define TEST_SIZE 5 * 1024 * 1024 int main(void) { int status; pid_t child; int fd = open("/proc/self/mem", O_RDWR); void *addr = mmap(NULL, TEST_SIZE, PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0); assert(addr != MAP_FAILED); pid_t parent_pid = getpid(); if ((child = fork()) == 0) { void *addr2 = mmap(NULL, TEST_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0); assert(addr2 != MAP_FAILED); memset(addr2, 'a', TEST_SIZE); pwrite(fd, addr2, TEST_SIZE, (uintptr_t)addr); return 0; } assert(child == waitpid(child, &status, 0)); assert(WIFEXITED(status) && WEXITSTATUS(status) == 0); return 0; } Fix this by updating follow_trans_huge_pmd in huge_memory.c analogously to the update in gup.c in the original commit. The same pattern exists in follow_devmap_pmd. However, we should not be able to reach that check with FOLL_COW set, so add WARN_ONCE to make sure we notice if we ever do. [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20170106015025.GA38411@juliacomputing.com Signed-off-by: Keno Fischer Acked-by: Kirill A. Shutemov Cc: Greg Thelen Cc: Nicholas Piggin Cc: Willy Tarreau Cc: Oleg Nesterov Cc: Kees Cook Cc: Andy Lutomirski Cc: Michal Hocko Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [AmitP: Minor refactoring of upstream changes for linux-3.18.y, where follow_devmap_pmd() doesn't exist.] Signed-off-by: Amit Pundir --- mm/huge_memory.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) -- 2.7.4 diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2e39d4e0ff09..8c9cbd0e4f3f 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1205,6 +1205,16 @@ out_unlock: return ret; } +/* + * FOLL_FORCE can write to even unwritable pmd's, but only + * after we've gone through a COW cycle and they are dirty. + */ +static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags) +{ + return pmd_write(pmd) || + ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd)); +} + struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, unsigned long addr, pmd_t *pmd, @@ -1215,7 +1225,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, assert_spin_locked(pmd_lockptr(mm, pmd)); - if (flags & FOLL_WRITE && !pmd_write(*pmd)) + if (flags & FOLL_WRITE && !can_follow_write_pmd(*pmd, flags)) goto out; /* Avoid dumping huge zero page */