From patchwork Fri Dec 13 12:25:19 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kemeng Shi X-Patchwork-Id: 13906410 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id EAC29E7716A for ; Fri, 13 Dec 2024 03:27:20 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 322DE6B0089; Thu, 12 Dec 2024 22:27:20 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 2D2A26B008C; Thu, 12 Dec 2024 22:27:20 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1752A6B0099; Thu, 12 Dec 2024 22:27:20 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id E6B686B008C for ; Thu, 12 Dec 2024 22:27:19 -0500 (EST) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 9283C43459 for ; Fri, 13 Dec 2024 03:27:19 +0000 (UTC) X-FDA: 82888499652.18.47EB186 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) by imf03.hostedemail.com (Postfix) with ESMTP id C3F732000F for ; Fri, 13 Dec 2024 03:27:03 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=none; spf=pass (imf03.hostedemail.com: domain of shikemeng@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=shikemeng@huaweicloud.com; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1734060411; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/b9Tn8mDfQuFCxPT50kx4ddB+W+6Fci8uTCYUWKol1M=; b=fw1M/hV09F0Q2Ly+kPEMJReO0XIAjZg9VKXfQAA/+3xFISiNUxs45z0lnvz0oXX/j7/NOY 60CS/BB7YqHLS2u4JfYHdwMDE7IFRp88zfYOTX4Ii/1W4mT2X9uoMcY/+NFtsOVQguHkbi ZxYbD6tQIeI5j4ncbgFpRTPYGcEnH4k= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=none; spf=pass (imf03.hostedemail.com: domain of shikemeng@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=shikemeng@huaweicloud.com; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1734060411; a=rsa-sha256; cv=none; b=7vbPlO2joK+dU+9PwCx+f5KZvWaXzf2M0Dooj55A1V0WxgbAA0mDiNSeQu5Ph6h+ta/gd9 jLIIzE8Aql2t5/nNWMHj3ses7//g9QwiIGj3veB5bPpWp8ROpqKV2/MwaJrLNJuyIOTfuY yzpsjcB6KkgzTe+ubY8F8HNgFFnEd4Y= Received: from mail.maildlp.com (unknown [172.19.163.235]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4Y8ZWg4QDnz4f3jkk for ; Fri, 13 Dec 2024 11:26:55 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id E81551A0568 for ; Fri, 13 Dec 2024 11:27:09 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.101.6]) by APP4 (Coremail) with SMTP id gCh0CgBHcISMqVtnfJ3KEQ--.55430S3; Fri, 13 Dec 2024 11:27:09 +0800 (CST) From: Kemeng Shi To: akpm@linux-foundation.org, willy@infradead.org Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH v3 1/5] Xarray: Do not return sibling entries from xas_find_marked() Date: Fri, 13 Dec 2024 20:25:19 +0800 Message-Id: <20241213122523.12764-2-shikemeng@huaweicloud.com> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20241213122523.12764-1-shikemeng@huaweicloud.com> References: <20241213122523.12764-1-shikemeng@huaweicloud.com> MIME-Version: 1.0 X-CM-TRANSID: gCh0CgBHcISMqVtnfJ3KEQ--.55430S3 X-Coremail-Antispam: 1UD129KBjvJXoWxZFyfJw18Wr15Cw43Kr15Arb_yoWrCF4fpF W8KFyDKr4ktr4UAr97Aay8XrWrW3y8XFWSyFWrGr1ayFnxA3WYkF1j9FyjqF9rZrWDAF4S yF40934UZF1DG3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPjb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M280x2IEY4vEnII2IxkI6r1a6r45M2 8IrcIa0xkI8VA2jI8067AKxVWUGwA2048vs2IY020Ec7CjxVAFwI0_Jrv_JF4l8cAvFVAK 0II2c7xJM28CjxkF64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVW5JVW7JwA2z4 x0Y4vE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28E F7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F4 0EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_ Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JMxkF7I0En4kS14v26r 126r1DMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAF wI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc4 0Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AK xVWUJVW8JwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr 1lIxAIcVC2z280aVCY1x0267AKxVWUJVW8JbIYCTnIWIevJa73UjIFyTuYvjxUswZ2DUUU U X-CM-SenderInfo: 5vklyvpphqwq5kxd4v5lfo033gof0z/ X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: C3F732000F X-Rspam-User: X-Stat-Signature: iqkx17xgf5x11e5xr9q7ge435stf1wi1 X-HE-Tag: 1734060423-727125 X-HE-Meta: U2FsdGVkX19qnj0gF2AffCy80SAg7wIkt2gtyZhZsRlgCSTBUF7187F+GmKxsyOpap4w7V+9j9NwCYsgDsAsH2xAMxuXG51JS8ZzuCf0/Nq05BUX/FGnfJ+5+KknpSnymkSk4Y2exd5Hw97cfRrSdRn/hMqo6ci6obuyYk8HnFe8SvfZQOP/FXsWkQdWNJf472SBkc0ic+dYwbaUALSlKu45J7KdHV40rGIJJP+fJJ/PlPjapOU0m/o434B63S/nrtxxf9FwPp0RW4VP59Gs00wQqQagPYr74LtUi6HnZIpaKji0SfElXAx28rT2t16p9/sIY8WmcUg4x0UuPH5/a17sApzDAAkfIxwxSTweD2kmvPEAh6PzTxKsSZmiDA83P3UjrJaq9ajfq8dsJYYak5qJklhfzXvfiXMHAech6Fct02pdJPNPcS2tbqlXbXdAxbOnu3zB+lvSeYPgU0f0rePv5UfOZg7DT3RoDhQRA+XfxR7hX8EN0jpnJazghedivecduma9YGs+O67K5EWL5Mzhvx+6wt/zFVB5p5/NxXqUzpOcUtPAlXwuq+al6Wi3H3As8UTOjZg2bx5QrmmMISETwDD/v6GKGSl1zws8KFHmssGFmseLkAnnp5LYRjKsIK+aVQdOwKVk+S6Wbflhd7ENLE5ddAFVGsS02NtYSaKERw9UokPtNSXZs6BCJtUDrVSiQJo4dhJh8/aWmWHZP2mnxuuEBtIFeJ7qA7wzKd+8Q3BzFZngUYbVKDLOks1toNCWStJaY+0okVzx0yCDj2kNTib6sYdaS8BrM2NCGGkvwNYs/lyrhcHkhOeqx3FKFX7bYxxTbUE0NCaBjXKQJWm6ZSkk8qOjwprAQe0irvpQ+hbdUp6u2eIxm7GklbhomLJgS/KGa1KWckCVmeaXbKVJza8BVeL1s1tQ+ozSxeBQWX3G+Pyl+19VoWH7J7ikDtjnOS8OVf1Lnq/t19l WY28620s QfgOz/5ZZaz2NE2umaiOJs/dWFDX59NE65NkPPRlRlRDF5gtpDhAMGw/z0vQ0hRUKjp6IiPmz6APFVgV71SNyntoEE4jpHxXQDg37lFY4MGhMaDCCAVLfdaEqLyBOFGF1WFjWPdYZ/EFT1UkTVX0Zyn6SusOoGaHPVBQLe+SCVb9YB5yFsXX7LcY7sl3gFzrYBFll84jyDgr4UOXkHZDyAIJqgQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Similar to issue fixed in commit cbc02854331ed ("XArray: Do not return sibling entries from xa_load()"), we may return sibling entries from xas_find_marked as following: Thread A: Thread B: xa_store_range(xa, entry, 6, 7, gfp); xa_set_mark(xa, 6, mark) XA_STATE(xas, xa, 6); xas_find_marked(&xas, 7, mark); offset = xas_find_chunk(xas, advance, mark); [offset is 6 which points to a valid entry] xa_store_range(xa, entry, 4, 7, gfp); entry = xa_entry(xa, node, 6); [entry is a sibling of 4] if (!xa_is_node(entry)) return entry; Skip sibling entry like xas_find() does to protect caller from seeing sibling entry from xas_find_marked() or caller may use sibling entry as a valid entry and crash the kernel. Besides, load_race() test is modified to catch mentioned issue and modified load_race() only passes after this fix is merged. Here is an example how this bug could be triggerred in tmpfs which enables large folio in mapping: Let's take a look at involved racer: 1. How pages could be created and dirtied in shmem file. write ksys_write vfs_write new_sync_write shmem_file_write_iter generic_perform_write shmem_write_begin shmem_get_folio shmem_allowable_huge_orders shmem_alloc_and_add_folios shmem_alloc_folio __folio_set_locked shmem_add_to_page_cache XA_STATE_ORDER(..., index, order) xax_store() shmem_write_end folio_mark_dirty() 2. How dirty pages could be deleted in shmem file. ioctl do_vfs_ioctl file_ioctl ioctl_preallocate vfs_fallocate shmem_fallocate shmem_truncate_range shmem_undo_range truncate_inode_folio filemap_remove_folio page_cache_delete xas_store(&xas, NULL); 3. How dirty pages could be lockless searched sync_file_range ksys_sync_file_range __filemap_fdatawrite_range filemap_fdatawrite_wbc do_writepages writeback_use_writepage writeback_iter writeback_get_folio filemap_get_folios_tag find_get_entry folio = xas_find_marked() folio_try_get(folio) Kernel will crash as following: 1.Create 2.Search 3.Delete /* write page 2,3 */ write ... shmem_write_begin XA_STATE_ORDER(xas, i_pages, index = 2, order = 1) xa_store(&xas, folio) shmem_write_end folio_mark_dirty() /* sync page 2 and page 3 */ sync_file_range ... find_get_entry folio = xas_find_marked() /* offset will be 2 */ offset = xas_find_chunk() /* delete page 2 and page 3 */ ioctl ... xas_store(&xas, NULL); /* write page 0-3 */ write ... shmem_write_begin XA_STATE_ORDER(xas, i_pages, index = 0, order = 2) xa_store(&xas, folio) shmem_write_end folio_mark_dirty(folio) /* get sibling entry from offset 2 */ entry = xa_entry(.., 2) /* use sibling entry as folio and crash kernel */ folio_try_get(folio) Signed-off-by: Kemeng Shi --- lib/xarray.c | 2 ++ tools/testing/radix-tree/multiorder.c | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/lib/xarray.c b/lib/xarray.c index 32d4bac8c94c..fa87949719a0 100644 --- a/lib/xarray.c +++ b/lib/xarray.c @@ -1382,6 +1382,8 @@ void *xas_find_marked(struct xa_state *xas, unsigned long max, xa_mark_t mark) entry = xa_entry(xas->xa, xas->xa_node, xas->xa_offset); if (!entry && !(xa_track_free(xas->xa) && mark == XA_FREE_MARK)) continue; + if (xa_is_sibling(entry)) + continue; if (!xa_is_node(entry)) return entry; xas->xa_node = xa_to_node(entry); diff --git a/tools/testing/radix-tree/multiorder.c b/tools/testing/radix-tree/multiorder.c index cffaf2245d4f..eaff1b036989 100644 --- a/tools/testing/radix-tree/multiorder.c +++ b/tools/testing/radix-tree/multiorder.c @@ -227,6 +227,7 @@ static void *load_creator(void *ptr) unsigned long index = (3 << RADIX_TREE_MAP_SHIFT) - (1 << order); item_insert_order(tree, index, order); + xa_set_mark(tree, index, XA_MARK_1); item_delete_rcu(tree, index); } } @@ -242,8 +243,11 @@ static void *load_worker(void *ptr) rcu_register_thread(); while (!stop_iteration) { + unsigned long find_index = (2 << RADIX_TREE_MAP_SHIFT) + 1; struct item *item = xa_load(ptr, index); assert(!xa_is_internal(item)); + item = xa_find(ptr, &find_index, index, XA_MARK_1); + assert(!xa_is_internal(item)); } rcu_unregister_thread();