From patchwork Tue May 2 16:34:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Stoakes X-Patchwork-Id: 13229151 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD807C77B7E for ; Tue, 2 May 2023 16:34:13 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 38DE9900004; Tue, 2 May 2023 12:34:13 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 33EE3900002; Tue, 2 May 2023 12:34:13 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 20727900004; Tue, 2 May 2023 12:34:13 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by kanga.kvack.org (Postfix) with ESMTP id C5B8F900002 for ; Tue, 2 May 2023 12:34:12 -0400 (EDT) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-3f315735514so177340085e9.1 for ; Tue, 02 May 2023 09:34:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1683045251; x=1685637251; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=nhB0IRLxm4wa8w9P3E/cdWzsBE01Yv6OZVORbiaGFU0=; b=YDFDqEJ+jijwp5Xgg/zBZJk2pHuAaVfH0bTQh5Mrnd1dph4E8MvglusxT3BuafMYy1 DVe+bCUpVIn7Ccx1KONHTZeXDPCp7GngAD0qCinV13UOdX/AYKB7XF6w5oojkaW5SECR 0jJRXb9qpzxRcnIbrypKHg69v5VPTgGHcSTyda1NSD6eBknGyD6uHPAGcpDkV4b0NDBq uSfHI+69oBeKj+esZHhrHxYOsgkKcFLKejeQz5jqI9ubOTvquyG7F/83hFZ+Q/N2jAup jKUkYHHwZ5dNION3PSM1f3FGp+MBzXts47JF0cihHh6jeLfE8uzIC4P8Vjcesfge9BpE FwBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683045251; x=1685637251; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=nhB0IRLxm4wa8w9P3E/cdWzsBE01Yv6OZVORbiaGFU0=; b=l+HchumcWvAvKWB5uZEWqw42RMUPJG1m8FmzG3spga2xhSDDOpPV+udtceQaFEfntR 185bqvcl7TRC85Ro9W3+O4yBQjaBx9i8JjXV11wqYEPKEEEDiEZ4xKxj07Hw3N7ysxsl uwH5i26uF48DZikAAveFsoiu8ic2aH24wXRJdVY+DZ16oaA9Aui2cchltVOBF0TnH6Hd vP+ofSrpJq++x0NFOp5jVDhUVmmsVT6/WRaaWR2Xwdw0HlfnN9XS7E7F43V71RSXrXUa ybemWf/bfVexVUlQL3QKF7GlBxB8jevel6IZI+yVYZN7SId8tq8QszXof9Apv6eYUd/A 99pg== X-Gm-Message-State: AC+VfDw1TlFAVlJnvDVrMpjq4hpe+O2frSEGZMmqAxERGRRpPaQNPnTw 88Ud3rYjXo2Z/b97sJ+Na1DS4IpK/ed8lg== X-Google-Smtp-Source: ACHHUZ7hKieE98kyd/eS6F3YMd/T4yvdygso79NLb5rerMkb0AJc+PQqfb8trJsSQW8QIQ9Cj9O/6g== X-Received: by 2002:a5d:564d:0:b0:2fa:88d3:f8b8 with SMTP id j13-20020a5d564d000000b002fa88d3f8b8mr16041618wrw.12.1683045251445; Tue, 02 May 2023 09:34:11 -0700 (PDT) Received: from lucifer.home (host86-156-84-164.range86-156.btcentralplus.com. [86.156.84.164]) by smtp.googlemail.com with ESMTPSA id b10-20020a5d550a000000b0030639a86f9dsm1789919wrv.51.2023.05.02.09.34.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 May 2023 09:34:10 -0700 (PDT) From: Lorenzo Stoakes To: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton Cc: Jason Gunthorpe , Jens Axboe , Matthew Wilcox , Dennis Dalessandro , Leon Romanovsky , Christian Benvenuti , Nelson Escobar , Bernard Metzler , Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Mark Rutland , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Ian Rogers , Adrian Hunter , Bjorn Topel , Magnus Karlsson , Maciej Fijalkowski , Jonathan Lemon , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Christian Brauner , Richard Cochran , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , linux-fsdevel@vger.kernel.org, linux-perf-users@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, Oleg Nesterov , Jason Gunthorpe , John Hubbard , Jan Kara , "Kirill A . Shutemov" , Pavel Begunkov , Mika Penttila , David Hildenbrand , Dave Chinner , Theodore Ts'o , Peter Xu , Matthew Rosato , "Paul E . McKenney" , Christian Borntraeger , Lorenzo Stoakes Subject: [PATCH v7 0/3] mm/gup: disallow GUP writing to file-backed mappings by default Date: Tue, 2 May 2023 17:34:02 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Writing to file-backed mappings which require folio dirty tracking using GUP is a fundamentally broken operation, as kernel write access to GUP mappings do not adhere to the semantics expected by a file system. A GUP caller uses the direct mapping to access the folio, which does not cause write notify to trigger, nor does it enforce that the caller marks the folio dirty. The problem arises when, after an initial write to the folio, writeback results in the folio being cleaned and then the caller, via the GUP interface, writes to the folio again. As a result of the use of this secondary, direct, mapping to the folio no write notify will occur, and if the caller does mark the folio dirty, this will be done so unexpectedly. For example, consider the following scenario:- 1. A folio is written to via GUP which write-faults the memory, notifying the file system and dirtying the folio. 2. Later, writeback is triggered, resulting in the folio being cleaned and the PTE being marked read-only. 3. The GUP caller writes to the folio, as it is mapped read/write via the direct mapping. 4. The GUP caller, now done with the page, unpins it and sets it dirty (though it does not have to). This change updates both the PUP FOLL_LONGTERM slow and fast APIs. As pin_user_pages_fast_only() does not exist, we can rely on a slightly imperfect whitelisting in the PUP-fast case and fall back to the slow case should this fail. v7: - Fixed very silly bug in writeable_file_mapping_allowed() inverting the logic. - Removed unnecessary RCU lock code and replaced with adaptation of Peter's idea. - Removed unnecessary open-coded folio_test_anon() in folio_longterm_write_pin_allowed() and restructured to generally permit NULL folio_mapping(). v6: - Rebased on latest mm-unstable as of 28th April 2023. - Add PUP-fast check with handling for rcu-locked TLB shootdown to synchronise correctly. - Split patch series into 3 to make it more digestible. https://lore.kernel.org/all/cover.1682981880.git.lstoakes@gmail.com/ v5: - Rebased on latest mm-unstable as of 25th April 2023. - Some small refactorings suggested by John. - Added an extended description of the problem in the comment around writeable_file_mapping_allowed() for clarity. - Updated commit message as suggested by Mika and John. https://lore.kernel.org/all/6b73e692c2929dc4613af711bdf92e2ec1956a66.1682638385.git.lstoakes@gmail.com/ v4: - Split out vma_needs_dirty_tracking() from vma_wants_writenotify() to reduce duplication and update to use this in the GUP check. Note that both separately check vm_ops_needs_writenotify() as the latter needs to test this before the vm_pgprot_modify() test, resulting in vma_wants_writenotify() checking this twice, however it is such a small check this should not be egregious. https://lore.kernel.org/all/3b92d56f55671a0389252379237703df6e86ea48.1682464032.git.lstoakes@gmail.com/ v3: - Rebased on latest mm-unstable as of 24th April 2023. - Explicitly check whether file system requires folio dirtying. Note that vma_wants_writenotify() could not be used directly as it is very much focused on determining if the PTE r/w should be set (e.g. assuming private mapping does not require it as already set, soft dirty considerations). - Tested code against shmem and hugetlb mappings - confirmed that these are not disallowed by the check. - Eliminate FOLL_ALLOW_BROKEN_FILE_MAPPING flag and instead perform check only for FOLL_LONGTERM pins. - As a result, limit check to internal GUP code. https://lore.kernel.org/all/23c19e27ef0745f6d3125976e047ee0da62569d4.1682406295.git.lstoakes@gmail.com/ v2: - Add accidentally excluded ptrace_access_vm() use of FOLL_ALLOW_BROKEN_FILE_MAPPING. - Tweak commit message. https://lore.kernel.org/all/c8ee7e02d3d4f50bb3e40855c53bda39eec85b7d.1682321768.git.lstoakes@gmail.com/ v1: https://lore.kernel.org/all/f86dc089b460c80805e321747b0898fd1efe93d7.1682168199.git.lstoakes@gmail.com/ Lorenzo Stoakes (3): mm/mmap: separate writenotify and dirty tracking logic mm/gup: disallow FOLL_LONGTERM GUP-nonfast writing to file-backed mappings mm/gup: disallow FOLL_LONGTERM GUP-fast writing to file-backed mappings include/linux/mm.h | 1 + mm/gup.c | 105 +++++++++++++++++++++++++++++++++++++++++++-- mm/mmap.c | 36 ++++++++++++---- 3 files changed, 130 insertions(+), 12 deletions(-) --- 2.40.1