[v2] mm/gup: handle NULL pages in unpin_user_pages()

Commit Message

John Hubbard Nov. 21, 2024, 3:49 a.m. UTC

The recent addition of "pofs" (pages or folios) handling to gup has a
flaw: it assumes that unpin_user_pages() handles NULL pages in the
pages** array. That's not the case, as I discovered when I ran on a new
configuration on my test machine.

Fix this by skipping NULL pages in unpin_user_pages(), just like
unpin_folios() already does.

Details: when booting on x86 with "numa=fake=2 movablecore=4G" on Linux
6.12, and running this:

    tools/testing/selftests/mm/gup_longterm

...I get the following crash:

BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: 0010:sanity_check_pinned_pages+0x3a/0x2d0
...
Call Trace:
 <TASK>
 ? __die_body+0x66/0xb0
 ? page_fault_oops+0x30c/0x3b0
 ? do_user_addr_fault+0x6c3/0x720
 ? irqentry_enter+0x34/0x60
 ? exc_page_fault+0x68/0x100
 ? asm_exc_page_fault+0x22/0x30
 ? sanity_check_pinned_pages+0x3a/0x2d0
 unpin_user_pages+0x24/0xe0
 check_and_migrate_movable_pages_or_folios+0x455/0x4b0
 __gup_longterm_locked+0x3bf/0x820
 ? mmap_read_lock_killable+0x12/0x50
 ? __pfx_mmap_read_lock_killable+0x10/0x10
 pin_user_pages+0x66/0xa0
 gup_test_ioctl+0x358/0xb20
 __se_sys_ioctl+0x6b/0xc0
 do_syscall_64+0x7b/0x150
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fixes: 94efde1d1539 ("mm/gup: avoid an unnecessary allocation call for FOLL_LONGTERM cases")
Cc: David Hildenbrand <[e-mail]>
Cc: Oscar Salvador <[e-mail]>
Cc: Vivek Kasireddy <[e-mail]>
Cc: Dave Airlie <[e-mail]>
Cc: Gerd Hoffmann <[e-mail]>
Cc: Matthew Wilcox <[e-mail]>
Cc: Christoph Hellwig <[e-mail]>
Cc: Jason Gunthorpe <[e-mail]>
Cc: Peter Xu <[e-mail]>
Cc: Arnd Bergmann <[e-mail]>
Cc: Daniel Vetter <[e-mail]>
Cc: Dongwon Kim <[e-mail]>
Cc: Hugh Dickins <[e-mail]>
Cc: Junxiao Chang <[e-mail]>
Cc: <[e-mail]>
Signed-off-by: John Hubbard <[e-mail]>
---

Hi,

This is based on v6.12.

Changes since v1:

Simplified by limiting the change to unpin_user_pages() and the
associated sanity_check_pinned_pages(), thanks to David Hildenbrand
for pointing out that issue in v1 [1].

[1] https://lore.kernel.org/[e-mail]

thanks,
John Hubbard




 mm/gup.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)


base-commit: adc218676eef25575469234709c2d87185ca223a

Comments

David Hildenbrand Nov. 21, 2024, 8:11 a.m. UTC | #1

On 21.11.24 04:49, John Hubbard wrote:
> The recent addition of "pofs" (pages or folios) handling to gup has a
> flaw: it assumes that unpin_user_pages() handles NULL pages in the
> pages** array. That's not the case, as I discovered when I ran on a new
> configuration on my test machine.
> 
> Fix this by skipping NULL pages in unpin_user_pages(), just like
> unpin_folios() already does.
> 
> Details: when booting on x86 with "numa=fake=2 movablecore=4G" on Linux
> 6.12, and running this:
> 
>      tools/testing/selftests/mm/gup_longterm
> 
> ...I get the following crash:
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000008
> RIP: 0010:sanity_check_pinned_pages+0x3a/0x2d0
> ...
> Call Trace:
>   <TASK>
>   ? __die_body+0x66/0xb0
>   ? page_fault_oops+0x30c/0x3b0
>   ? do_user_addr_fault+0x6c3/0x720
>   ? irqentry_enter+0x34/0x60
>   ? exc_page_fault+0x68/0x100
>   ? asm_exc_page_fault+0x22/0x30
>   ? sanity_check_pinned_pages+0x3a/0x2d0
>   unpin_user_pages+0x24/0xe0
>   check_and_migrate_movable_pages_or_folios+0x455/0x4b0
>   __gup_longterm_locked+0x3bf/0x820
>   ? mmap_read_lock_killable+0x12/0x50
>   ? __pfx_mmap_read_lock_killable+0x10/0x10
>   pin_user_pages+0x66/0xa0
>   gup_test_ioctl+0x358/0xb20
>   __se_sys_ioctl+0x6b/0xc0
>   do_syscall_64+0x7b/0x150
>   entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> Fixes: 94efde1d1539 ("mm/gup: avoid an unnecessary allocation call for FOLL_LONGTERM cases")
> Cc: David Hildenbrand <[e-mail]>
> Cc: Oscar Salvador <[e-mail]>
> Cc: Vivek Kasireddy <[e-mail]>
> Cc: Dave Airlie <[e-mail]>
> Cc: Gerd Hoffmann <[e-mail]>
> Cc: Matthew Wilcox <[e-mail]>
> Cc: Christoph Hellwig <[e-mail]>
> Cc: Jason Gunthorpe <[e-mail]>
> Cc: Peter Xu <[e-mail]>
> Cc: Arnd Bergmann <[e-mail]>
> Cc: Daniel Vetter <[e-mail]>
> Cc: Dongwon Kim <[e-mail]>
> Cc: Hugh Dickins <[e-mail]>
> Cc: Junxiao Chang <[e-mail]>
> Cc: <[e-mail]>
> Signed-off-by: John Hubbard <[e-mail]>
> ---

Thanks!

Acked-by: David Hildenbrand <[e-mail]>

Patch

diff --git a/mm/gup.c b/mm/gup.c
index ad0c8922dac3..7053f8114e01 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -52,7 +52,12 @@  static inline void sanity_check_pinned_pages(struct page **pages,
 	 */
 	for (; npages; npages--, pages++) {
 		struct page *page = *pages;
-		struct folio *folio = page_folio(page);
+		struct folio *folio;
+
+		if (!page)
+			continue;
+
+		folio = page_folio(page);
 
 		if (is_zero_page(page) ||
 		    !folio_test_anon(folio))
@@ -409,6 +414,10 @@  void unpin_user_pages(struct page **pages, unsigned long npages)
 
 	sanity_check_pinned_pages(pages, npages);
 	for (i = 0; i < npages; i += nr) {
+		if (!pages[i]) {
+			nr = 1;
+			continue;
+		}
 		folio = gup_folio_next(pages, npages, i, &nr);
 		gup_put_folio(folio, nr, FOLL_PIN);
 	}