[v3,0/3] Avoid live-lock in btrfs fault-in+uaccess loop

Message

Catalin Marinas April 6, 2022, 6:09 p.m. UTC

Hi,

I finally got around to reviving this series. However, I simplified it
from v2 and focussed on solving the btrfs search_ioctl() problem only:

https://lore.kernel.org/r/[e-mail]

The btrfs search_ioctl() function can potentially live-lock on arm64
with MTE enabled due to a fault_in_writeable() + copy_to_user_nofault()
unbounded loop. The uaccess can fault in the middle of a page (MTE tag
check fault) even if a prior fault_in_writeable() successfully wrote to
the beginning of that page. The btrfs loop always restarts the fault-in
loop from the beginning of the user buffer, hence the live-lock.

The series introduces fault_in_subpage_writeable() together with the
arm64 probing counterpart and the btrfs fix.

I don't think with the current kernel anything other than btrfs
search_ioctl() can live-lock. The buffered file I/O can already cope
with current fault_in_*() + copy_*_user() loops (the uaccess makes
progress). Direct I/O either goes via GUP + kernel mapping access (and
memcpy() can't fault) or, if the user buffer is not PAGE aligned, it may
fall back to buffered I/O. So we really only care about
fault_in_writeable(), hence this simplified series. If at some point
we'll need to address other places, we can expand the sub-page probing
to the other fault_in_*() functions.

Thanks.

Catalin Marinas (3):
  mm: Add fault_in_subpage_writeable() to probe at sub-page granularity
  arm64: Add support for user sub-page fault probing
  btrfs: Avoid live-lock in search_ioctl() on hardware with sub-page
    faults

 arch/Kconfig                     |  7 +++++++
 arch/arm64/Kconfig               |  1 +
 arch/arm64/include/asm/mte.h     |  1 +
 arch/arm64/include/asm/uaccess.h | 15 +++++++++++++++
 arch/arm64/kernel/mte.c          | 30 ++++++++++++++++++++++++++++++
 fs/btrfs/ioctl.c                 |  7 ++++++-
 include/linux/pagemap.h          |  1 +
 include/linux/uaccess.h          | 22 ++++++++++++++++++++++
 mm/gup.c                         | 29 +++++++++++++++++++++++++++++
 9 files changed, 112 insertions(+), 1 deletion(-)