From patchwork Mon Jul 25 14:20:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Xu X-Patchwork-Id: 12928122 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CA93C43334 for ; Mon, 25 Jul 2022 14:21:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E56FB940007; Mon, 25 Jul 2022 10:21:20 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E0696900002; Mon, 25 Jul 2022 10:21:20 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CCE91940007; Mon, 25 Jul 2022 10:21:20 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id BED73900002 for ; Mon, 25 Jul 2022 10:21:20 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 97FFD1402D2 for ; Mon, 25 Jul 2022 14:21:20 +0000 (UTC) X-FDA: 79725834720.06.E9EBEC6 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf28.hostedemail.com (Postfix) with ESMTP id AA1EFC00B3 for ; Mon, 25 Jul 2022 14:20:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1658758854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=L+PLJwm8I4XNgq7thKsEyZwGg7Y79QmzOuQLBYBftOA=; b=bO4TuYVoHBVDAp21AMS7FiXdeXBvovCvhniJCRTTs+wfupD2Es7ArgdzCLoOkbiK9KMcV+ +Ubt0YtOtSY1yJFAHvggPAfOp4e+5DaJKGIKRx+I/UUGSicx9zxrXAOhefiajaZbDKOQhu neBKZbU67XdmINkJhWtL2mtWfVnwkrE= Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-67-AzVR0b2dP9qPvJfohjX9rQ-1; Mon, 25 Jul 2022 10:20:52 -0400 X-MC-Unique: AzVR0b2dP9qPvJfohjX9rQ-1 Received: by mail-qv1-f70.google.com with SMTP id e1-20020ad44181000000b00472f8ad6e71so7729567qvp.20 for ; Mon, 25 Jul 2022 07:20:52 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=L+PLJwm8I4XNgq7thKsEyZwGg7Y79QmzOuQLBYBftOA=; b=6xP+GUkJ1tKj/pnw7KH3sFglgae3vSRcJ8eDE1w/u5YUAZKx4TifGOAuUh3L+gJ4EF lHzjYSneXNq1v4vLMGxCX2sGj0coiqbfSCYJ40tSGuqXskB2VJ4qQE+p5Ur+4+EFDPM4 NUdHw8WoObQLIJZXeqEa5jWQ1JQqvXvrFEa5BxJV1opITqjcoeVFi8mek0E/XetU+zLq UyTxEX6JcQ3pnnc2fdeBYT4AzLEAERrGCWwjyhj8LBdkXbj2ZU4qxsQM/UOWuXnrC+XZ RDI8vD51YLmUKk9EBW1qSbo6ImNVntVt1d0FR3f+e/YTjMgqu7U3Gh9/QfiOz5cHC3Ir UrRg== X-Gm-Message-State: AJIora9H9CTKxIOju3QSiefIJzBAOmKIY4PVvQgfDluKVmXI7Pd2ottD LEAUxe44j3U1mg4bzjdqtcIOxm6RlIdJDNiKhMQFs/FLBW6+UrqmfgZiFeEelj6LxbKf+gToqUy ZTtPx57vTDZ8= X-Received: by 2002:a05:620a:29d6:b0:6b5:bd2a:7d6c with SMTP id s22-20020a05620a29d600b006b5bd2a7d6cmr8958395qkp.322.1658758851811; Mon, 25 Jul 2022 07:20:51 -0700 (PDT) X-Google-Smtp-Source: AGRyM1vQlOnDDtn0B1X4C7h3+oTl7Q6HIl52JZgS9lE9HukTaSgN/hsfyN4YSFElUBcqMbdEwPEPzQ== X-Received: by 2002:a05:620a:29d6:b0:6b5:bd2a:7d6c with SMTP id s22-20020a05620a29d600b006b5bd2a7d6cmr8958367qkp.322.1658758851484; Mon, 25 Jul 2022 07:20:51 -0700 (PDT) Received: from localhost.localdomain (bras-base-aurron9127w-grc-35-70-27-3-10.dsl.bell.ca. [70.27.3.10]) by smtp.gmail.com with ESMTPSA id ey14-20020a05622a4c0e00b0031f0ab4eceasm7626071qtb.7.2022.07.25.07.20.50 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 25 Jul 2022 07:20:50 -0700 (PDT) From: Peter Xu To: linux-kernel@vger.kernel.org, linux-mm@kvack.org Cc: peterx@redhat.com, Nadav Amit , Andrea Arcangeli , Andrew Morton , David Hildenbrand Subject: [PATCH v4 1/3] mm/mprotect: Fix soft-dirty check in can_change_pte_writable() Date: Mon, 25 Jul 2022 10:20:46 -0400 Message-Id: <20220725142048.30450-2-peterx@redhat.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220725142048.30450-1-peterx@redhat.com> References: <20220725142048.30450-1-peterx@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-type: text/plain X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: AA1EFC00B3 Authentication-Results: imf28.hostedemail.com; dkim=temperror ("DNS error when getting key") header.d=redhat.com header.s=mimecast20190719 header.b=bO4TuYVo; dmarc=temperror reason="query timed out" header.from=redhat.com (policy=temperror); spf=temperror (imf28.hostedemail.com: error in processing during lookup of peterx@redhat.com: DNS error) smtp.mailfrom=peterx@redhat.com X-Stat-Signature: kcn8tmy641ejtijghsf6bukcwzni7y5h X-HE-Tag: 1658758854-898250 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The check wanted to make sure when soft-dirty tracking is enabled we won't grant write bit by accident, as a page fault is needed for dirty tracking. The intention is correct but we didn't check it right because VM_SOFTDIRTY set actually means soft-dirty tracking disabled. Fix it. There's another thing tricky about soft-dirty is that, we can't check the vma flag !(vma_flags & VM_SOFTDIRTY) directly but only check it after we checked CONFIG_MEM_SOFT_DIRTY because otherwise VM_SOFTDIRTY will be defined as zero, and !(vma_flags & VM_SOFTDIRTY) will constantly return true. To avoid misuse, introduce a helper for checking whether vma has soft-dirty tracking enabled. We can easily verify this with any exclusive anonymous page, like program below: =======8<====== #include #include #include #include #include #include #include #include #include #include #include #include #include #define BIT_ULL(nr) (1ULL << (nr)) #define PM_SOFT_DIRTY BIT_ULL(55) unsigned int psize; char *page; uint64_t pagemap_read_vaddr(int fd, void *vaddr) { uint64_t value; int ret; ret = pread(fd, &value, sizeof(uint64_t), ((uint64_t)vaddr >> 12) * sizeof(uint64_t)); assert(ret == sizeof(uint64_t)); return value; } void clear_refs_write(void) { int fd = open("/proc/self/clear_refs", O_RDWR); assert(fd >= 0); write(fd, "4", 2); close(fd); } #define check_soft_dirty(str, expect) do { \ bool dirty = pagemap_read_vaddr(fd, page) & PM_SOFT_DIRTY; \ if (dirty != expect) { \ printf("ERROR: %s, soft-dirty=%d (expect: %d)\n", str, dirty, expect); \ exit(-1); \ } \ } while (0) int main(void) { int fd = open("/proc/self/pagemap", O_RDONLY); assert(fd >= 0); psize = getpagesize(); page = mmap(NULL, psize, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); assert(page != MAP_FAILED); *page = 1; check_soft_dirty("Just faulted in page", 1); clear_refs_write(); check_soft_dirty("Clear_refs written", 0); mprotect(page, psize, PROT_READ); check_soft_dirty("Marked RO", 0); mprotect(page, psize, PROT_READ|PROT_WRITE); check_soft_dirty("Marked RW", 0); *page = 2; check_soft_dirty("Wrote page again", 1); munmap(page, psize); close(fd); printf("Test passed.\n"); return 0; } =======8<====== Here we attach a Fixes to commit 64fe24a3e05e only for easy tracking, as this patch won't apply to a tree before that point. However the commit wasn't the source of problem, but instead 64e455079e1b. It's just that after 64fe24a3e05e anonymous memory will also suffer from this problem with mprotect(). Fixes: 64e455079e1b ("mm: softdirty: enable write notifications on VMAs after VM_SOFTDIRTY cleared") Fixes: 64fe24a3e05e ("mm/mprotect: try avoiding write faults for exclusive anonymous pages when changing protection") Reviewed-by: David Hildenbrand Signed-off-by: Peter Xu --- mm/internal.h | 18 ++++++++++++++++++ mm/mmap.c | 2 +- mm/mprotect.c | 2 +- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/mm/internal.h b/mm/internal.h index 15e8cb118832..e2d442e3c0b2 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -860,4 +860,22 @@ struct folio *try_grab_folio(struct page *page, int refs, unsigned int flags); DECLARE_PER_CPU(struct per_cpu_nodestat, boot_nodestats); +static inline bool vma_soft_dirty_enabled(struct vm_area_struct *vma) +{ + /* + * NOTE: we must check this before VM_SOFTDIRTY on soft-dirty + * enablements, because when without soft-dirty being compiled in, + * VM_SOFTDIRTY is defined as 0x0, then !(vm_flags & VM_SOFTDIRTY) + * will be constantly true. + */ + if (!IS_ENABLED(CONFIG_MEM_SOFT_DIRTY)) + return false; + + /* + * Soft-dirty is kind of special: its tracking is enabled when the + * vma flags not set. + */ + return !(vma->vm_flags & VM_SOFTDIRTY); +} + #endif /* __MM_INTERNAL_H */ diff --git a/mm/mmap.c b/mm/mmap.c index 125e8903c93c..93f9913409ea 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1518,7 +1518,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot) return 0; /* Do we need to track softdirty? */ - if (IS_ENABLED(CONFIG_MEM_SOFT_DIRTY) && !(vm_flags & VM_SOFTDIRTY)) + if (vma_soft_dirty_enabled(vma)) return 1; /* Specialty mapping? */ diff --git a/mm/mprotect.c b/mm/mprotect.c index 0420c3ed936c..c403e84129d4 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -49,7 +49,7 @@ static inline bool can_change_pte_writable(struct vm_area_struct *vma, return false; /* Do we need write faults for softdirty tracking? */ - if ((vma->vm_flags & VM_SOFTDIRTY) && !pte_soft_dirty(pte)) + if (vma_soft_dirty_enabled(vma) && !pte_soft_dirty(pte)) return false; /* Do we need write faults for uffd-wp tracking? */