| Message ID | 20240112013935.1474648-1-surenb@google.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] userfaultfd: avoid huge_zero_page in UFFDIO_MOVE | expand |
On 12.01.24 02:39, Suren Baghdasaryan wrote: > While testing UFFDIO_MOVE ioctl, syzbot triggered VM_BUG_ON_PAGE caused > by a call to PageAnonExclusive() with a huge_zero_page as a parameter. > UFFDIO_MOVE does not yet handle zeropages and returns EBUSY when one is > encountered. Add an early huge_zero_page check in the PMD move path > to avoid this situation. > > Reported-by: syzbot+705209281e36404998f6@syzkaller.appspotmail.com > Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") > Signed-off-by: Suren Baghdasaryan <surenb@google.com> > --- > Applies cleanly over linux-next, mm-stable and mm-unstable branches > > mm/userfaultfd.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c > index 216ab4c8621f..20e3b0d9cf7e 100644 > --- a/mm/userfaultfd.c > +++ b/mm/userfaultfd.c > @@ -1393,6 +1393,12 @@ ssize_t move_pages(struct userfaultfd_ctx *ctx, struct mm_struct *mm, > err = -ENOENT; > break; > } > + /* Avoid moving zeropages for now */ > + if (is_huge_zero_pmd(*src_pmd)) { > + spin_unlock(ptl); > + err = -EBUSY; > + break; > + } As an alternative (and more future proof?) just reject anything that is not an anon folio as well? Anyhow, this should handle the issue at hand. Acked-by: David Hildenbrand <david@redhat.com>
On Fri, Jan 12, 2024 at 12:57 AM David Hildenbrand <david@redhat.com> wrote: > > On 12.01.24 02:39, Suren Baghdasaryan wrote: > > While testing UFFDIO_MOVE ioctl, syzbot triggered VM_BUG_ON_PAGE caused > > by a call to PageAnonExclusive() with a huge_zero_page as a parameter. > > UFFDIO_MOVE does not yet handle zeropages and returns EBUSY when one is > > encountered. Add an early huge_zero_page check in the PMD move path > > to avoid this situation. > > > > Reported-by: syzbot+705209281e36404998f6@syzkaller.appspotmail.com > > Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") > > Signed-off-by: Suren Baghdasaryan <surenb@google.com> > > --- > > Applies cleanly over linux-next, mm-stable and mm-unstable branches > > > > mm/userfaultfd.c | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > > diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c > > index 216ab4c8621f..20e3b0d9cf7e 100644 > > --- a/mm/userfaultfd.c > > +++ b/mm/userfaultfd.c > > @@ -1393,6 +1393,12 @@ ssize_t move_pages(struct userfaultfd_ctx *ctx, struct mm_struct *mm, > > err = -ENOENT; > > break; > > } > > + /* Avoid moving zeropages for now */ > > + if (is_huge_zero_pmd(*src_pmd)) { > > + spin_unlock(ptl); > > + err = -EBUSY; > > + break; > > + } > > As an alternative (and more future proof?) just reject anything that is > not an anon folio as well? Yes, but I'm going to remove this check shortly, once zeropage movement patch is ready. > > Anyhow, this should handle the issue at hand. > > Acked-by: David Hildenbrand <david@redhat.com> Thanks! > > -- > Cheers, > > David / dhildenb >
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 216ab4c8621f..20e3b0d9cf7e 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -1393,6 +1393,12 @@ ssize_t move_pages(struct userfaultfd_ctx *ctx, struct mm_struct *mm, err = -ENOENT; break; } + /* Avoid moving zeropages for now */ + if (is_huge_zero_pmd(*src_pmd)) { + spin_unlock(ptl); + err = -EBUSY; + break; + } /* Check if we can move the pmd without splitting it. */ if (move_splits_huge_pmd(dst_addr, src_addr, src_start + len) ||
While testing UFFDIO_MOVE ioctl, syzbot triggered VM_BUG_ON_PAGE caused by a call to PageAnonExclusive() with a huge_zero_page as a parameter. UFFDIO_MOVE does not yet handle zeropages and returns EBUSY when one is encountered. Add an early huge_zero_page check in the PMD move path to avoid this situation. Reported-by: syzbot+705209281e36404998f6@syzkaller.appspotmail.com Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") Signed-off-by: Suren Baghdasaryan <surenb@google.com> --- Applies cleanly over linux-next, mm-stable and mm-unstable branches mm/userfaultfd.c | 6 ++++++ 1 file changed, 6 insertions(+)