From patchwork Tue Mar 12 18:11:18 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Hildenbrand X-Patchwork-Id: 13590454 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C001C54E58 for ; Tue, 12 Mar 2024 18:11:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DD30F8E0006; Tue, 12 Mar 2024 14:11:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D83048D0017; Tue, 12 Mar 2024 14:11:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C4AAA8E0006; Tue, 12 Mar 2024 14:11:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id B570A8D0017 for ; Tue, 12 Mar 2024 14:11:30 -0400 (EDT) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 935DA1A0A5B for ; Tue, 12 Mar 2024 18:11:30 +0000 (UTC) X-FDA: 81889179540.17.A659BCF Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf04.hostedemail.com (Postfix) with ESMTP id C893140021 for ; Tue, 12 Mar 2024 18:11:28 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=UUnBElGu; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf04.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1710267088; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=QDV9x+7F96bUT8ZplUut026NxQLyg/9WyFP+QKSKcOg=; b=SNzVhbVFFMVPcWVL+jwqu6pr8In14hNOiRxlbF9FGHmsP4/Lyn6VkwdoeWLJcFeBNvISGG eM6kS33K25iDPu+EyvhQ5rUCEjMCx7yqP+PWKtRH8Gya1WjOwMjMmFyD7IL6LJHU1UHE90 qTk+njIeWc9VrBNYXDDEQZ52NBOz4kE= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=UUnBElGu; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf04.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1710267088; a=rsa-sha256; cv=none; b=VurWTQ6Ik3x3p1gmLbb4swaIN637aj2/G1KEvhVykQ3OLp1uC2i41GyRzqJa0JFxaO7+3+ ObkcPxj/QgV9RDIKoM2MGa4yOUTqlTUEvvhme93rRQ3lS1BsBQ5cGRqNEtHyNAGNKn/xZZ JxKV76dMWs9F57TIwB0jegdNvVuJZ9s= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1710267088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=QDV9x+7F96bUT8ZplUut026NxQLyg/9WyFP+QKSKcOg=; b=UUnBElGuvHIFdqHp0MHxJQChbfg1BP1Xjb+2x5oteQlNwXmiZ7Jx/THV8pP0+HS9YvqL4F SVsjsVYWG0ZlUnCg2wzVFDEaqBgGEWyFnSFrDt8L3fl8G3tRYK2/Id+FWaTUoQjWBQLuzh jcwhLQ6qPouCvB4vRMoy5caT4FzzfYo= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-343-CSwAWI_fNK6YyzOGkSGKaA-1; Tue, 12 Mar 2024 14:11:22 -0400 X-MC-Unique: CSwAWI_fNK6YyzOGkSGKaA-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B3F53185A789; Tue, 12 Mar 2024 18:11:21 +0000 (UTC) Received: from t14s.fritz.box (unknown [10.39.195.49]) by smtp.corp.redhat.com (Postfix) with ESMTP id CFE831121337; Tue, 12 Mar 2024 18:11:18 +0000 (UTC) From: David Hildenbrand To: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, x86@kernel.org, David Hildenbrand , Wupeng Ma , Dave Hansen , Andy Lutomirski , Peter Zijlstra , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , Andrew Morton Subject: [PATCH v1] x86/mm/pat: fix VM_PAT handling in COW mappings Date: Tue, 12 Mar 2024 19:11:18 +0100 Message-ID: <20240312181118.318701-1-david@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.3 X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: C893140021 X-Stat-Signature: 91b451ueox81x7nmdr4psy87arngp8xw X-HE-Tag: 1710267088-652771 X-HE-Meta: U2FsdGVkX19n/Sc+u0EVfNJPlI/Fj1czbLlkDps3jX8c/RbbkVo/M0aVEBuatrR99jXeroF0OWj+PC9QY1CSGjCC4vAtitMnYwKJBdSiJY8eGZgwvLGnB20ielGjqBpczNHbvdZKYnIeG8jx6KSUF5XEnfmShI7F6c1SUr57TorgHj8uFNFCsMpmf9N83vqDdL1kMrKvgR3jy4+lXSrTm/oR1fiTPDL1vcM7o7x0riQIL8j50MZRCTQ/i1v1iAeTOEUGhQ3S/Qkd9LSVU7AAbE3tK/qdkO382bRfl4kjo2R2VQElxhnpFZKq47lrd60rcUaEuIGdO8LS1g6LAKFztpMH5Hp3JzPuiY7O5mC8ZHz4aEqI3YIO1oU9Sqdt+HYOah/l0m765qZ6Q/3eezqPaNuim3w6jgNTbkpCvc1ZNIkb19lUYq5HJYtrS/3i/vG9Ic78wi8Kryf/JpmfRBPBQF+YBjmKysXwDb02x3COdkE3yyeuqNeOoqv65ewY0Dtu5szkVZSsrbJ0KWr0HS8kaxHAKGb+st6gRjfaWERrJjJ7aIo8xvu9XpZ6yp/M+98pS0grObzzds69XUBn8UgRok8X6/tYGQLHtSUV67qd3uz/CS+Zotwlr6J26VOiwD/1nxfesaWK+EIiww1iSfEQttTyumqHpP5kbxqByTMTtKbGCstQANHjCDx0+XHxEypNVdgbddIVeywWQC5h94Y2rCB6YqD2gr2eTt6OtQ7Gb7zxduZvV65xCFTfu8G4QR2IgndpUsbU/8dKAShPE9KVWHgNaZPIq+QASHPQDx1+NUB958rNkkRiyVXcgbubBZHUdH1YATU5/CN/EtJ7TlILbR5RMUmrIEFnsWWg5Iy1iv2re+udLHr9rs8DgNMTg5NzgYKky7SmX9w3zD64StKIQy09eZFdECinVXp1wMpR6YFkmTjnZysyUkMmwGlSmdcqO2fQy5CbSAYq87QWpeP lbEtCUtX KalFveetpOovwn3huKQ+Os8x1VQIqdsFkDoJcuhcTX2ryCtzFC/elrfw1BtdVREnfv0FAX9zA9aV1g6DK3xBNc/9n2JA4KLackHY8IU3u12GEln4SpBsrl+ykwr/ZjCGY20z8/IWUwdHOE3MPLhMkYy5fn2K27RoSLwZJKuQS2oRJ44AWzOnsy6y5obNikz9hEksKyl7XL+ZS92jrz8F9kW4PKDFaZc+XnffyOZDuKvF+Z1g4b/YbrCATO6R8dflu4gbiDKwmzSRPupd/INR7+UlH/IIs2LC1VdcN01GjZnxjNmV9PkSnhz3KI+r/rRxphy5c3jQH5oFixBEpnEI3KCfqB0w8GtQHpo7WMYUNxbI3r7KW7Kd6jSV16AG7kVfxZqtusZMqbr6zGhTpCKJF0YHC0/azcaEvx6y/nn78ZFogNsVFiZDF8+w1uWSsHpbNrs9pJ8V4anZO03YMnEYnNCr2ld78CWmTH1kfQDqvOKcNN6GBOc23RX3AgeOax9EVgNVu X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: PAT handling won't do the right thing in COW mappings: the first PTE (or, in fact, all PTEs) can be replaced during write faults to point at anon folios. Reliably recovering the correct PFN and cachemode using follow_phys() from PTEs will not work in COW mappings. Using follow_phys(), we might just get the address+protection of the anon folio (which is very wrong), or fail on swap/nonswap entries, failing follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and track_pfn_copy(), not properly calling free_pfn_range(). In free_pfn_range(), we either wouldn't call memtype_free() or would call it with the wrong range, possibly leaking memory. To fix that, let's update follow_phys() to refuse returning anon folios, and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings if we run into that. We will now properly handle untrack_pfn() with COW mappings, where we don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if the first page was replaced by an anon folio, though: we'd have to store the cachemode in the VMA to make this work, likely growing the VMA size. For now, lets keep it simple and let track_pfn_copy() just fail in that case: it would have failed in the past with swap/nonswap entries already, and it would have done the wrong thing with anon folios. Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn(): <--- C reproducer ---> #include #include #include #include int main(void) { struct io_uring_params p = {}; int ring_fd; size_t size; char *map; ring_fd = io_uring_setup(1, &p); if (ring_fd < 0) { perror("io_uring_setup"); return 1; } size = p.sq_off.array + p.sq_entries * sizeof(unsigned); /* Map the submission queue ring MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (map == MAP_FAILED) { perror("mmap"); return 1; } /* We have at least one page. Let's COW it. */ *map = 0; pause(); return 0; } <--- C reproducer ---> On a system with 16 GiB RAM and swap configured: # ./iouring & # memhog 16G # killall iouring [ 301.552930] ------------[ cut here ]------------ [ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047 [ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 [ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] PKRU: 55555554 [ 301.565944] Call Trace: [ 301.566148] [ 301.566325] ? untrack_pfn+0xf4/0x100 [ 301.566618] ? __warn+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 301.567163] ? report_bug+0x171/0x1a0 [ 301.567466] ? handle_bug+0x3c/0x80 [ 301.567743] ? exc_invalid_op+0x17/0x70 [ 301.568038] ? asm_exc_invalid_op+0x1a/0x20 [ 301.568363] ? untrack_pfn+0xf4/0x100 [ 301.568660] ? untrack_pfn+0x65/0x100 [ 301.568947] unmap_single_vma+0xa6/0xe0 [ 301.569247] unmap_vmas+0xb5/0x190 [ 301.569532] exit_mmap+0xec/0x340 [ 301.569801] __mmput+0x3e/0x130 [ 301.570051] do_exit+0x305/0xaf0 ... Reported-by: Wupeng Ma Closes: https://lkml.kernel.org/r/20240227122814.3781907-1-mawupeng1@huawei.com Fixes: b1a86e15dc03 ("x86, pat: remove the dependency on 'vm_pgoff' in track/untrack pfn vma routines") Fixes: 5899329b1910 ("x86: PAT: implement track/untrack of pfnmap regions for x86 - v3") Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Andrew Morton Signed-off-by: David Hildenbrand --- On top of mm/mm-unstable. I spent way too much time trying to squeeze the cachemode into the VMA in a clean way. I even went the extra mile and tried to get rid of follow_phys() completely, storing the cachemode and the PFN in the VMA. But I didn't quite like the end result and decided to just keep it simple and not care about improving the already-broken fork() corner case. follow_phys() is rather ugly, and I have some patches to improve the situation. But let's get this fix here out first and discuss if there is an alternative. --- arch/x86/mm/pat/memtype.c | 49 ++++++++++++++++++++++++++++----------- mm/memory.c | 4 ++++ 2 files changed, 39 insertions(+), 14 deletions(-) diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c index 0904d7e8e1260..82857148dbec5 100644 --- a/arch/x86/mm/pat/memtype.c +++ b/arch/x86/mm/pat/memtype.c @@ -950,6 +950,38 @@ static void free_pfn_range(u64 paddr, unsigned long size) memtype_free(paddr, paddr + size); } +static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr, + pgprot_t *pgprot) +{ + unsigned long prot; + + VM_WARN_ON_ONCE(!(vma->vm_flags & VM_PAT)); + + /* + * We need the starting PFN and cachemode used for track_pfn_remap() + * that covered the whole VMA. For most mappings, we can obtain that + * information from the page tables. For COW mappings, we might now + * suddenly have anon folios mapped and follow_phys() will fail. + * + * Fallback to using vma->vm_pgoff, see remap_pfn_range_notrack(), to + * detect the PFN. If we need the cachemode as well, we're out of luck + * for now and have to fail fork(). + */ + if (!follow_phys(vma, vma->vm_start, 0, &prot, paddr)) { + if (pgprot) + *pgprot = __pgprot(prot); + return 0; + } + if (is_cow_mapping(vma->vm_flags)) { + if (pgprot) + return -EINVAL; + *paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT; + return 0; + } + WARN_ON_ONCE(1); + return -EINVAL; +} + /* * track_pfn_copy is called when vma that is covering the pfnmap gets * copied through copy_page_range(). @@ -960,20 +992,13 @@ static void free_pfn_range(u64 paddr, unsigned long size) int track_pfn_copy(struct vm_area_struct *vma) { resource_size_t paddr; - unsigned long prot; unsigned long vma_size = vma->vm_end - vma->vm_start; pgprot_t pgprot; if (vma->vm_flags & VM_PAT) { - /* - * reserve the whole chunk covered by vma. We need the - * starting address and protection from pte. - */ - if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) { - WARN_ON_ONCE(1); + if (get_pat_info(vma, &paddr, &pgprot)) return -EINVAL; - } - pgprot = __pgprot(prot); + /* reserve the whole chunk covered by vma. */ return reserve_pfn_range(paddr, vma_size, &pgprot, 1); } @@ -1048,7 +1073,6 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn, unsigned long size, bool mm_wr_locked) { resource_size_t paddr; - unsigned long prot; if (vma && !(vma->vm_flags & VM_PAT)) return; @@ -1056,11 +1080,8 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn, /* free the chunk starting from pfn or the whole chunk */ paddr = (resource_size_t)pfn << PAGE_SHIFT; if (!paddr && !size) { - if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) { - WARN_ON_ONCE(1); + if (get_pat_info(vma, &paddr, NULL)) return; - } - size = vma->vm_end - vma->vm_start; } free_pfn_range(paddr, size); diff --git a/mm/memory.c b/mm/memory.c index f2bc6dd15eb83..bd3336fa5b66a 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5971,6 +5971,10 @@ int follow_phys(struct vm_area_struct *vma, goto out; pte = ptep_get(ptep); + /* Never return PFNs of anon folios in COW mappings. */ + if (vm_normal_folio(vma, address, pte)) + goto unlock; + if ((flags & FOLL_WRITE) && !pte_write(pte)) goto unlock;