From patchwork Wed Aug 26 15:14:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 11738969 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A2A681731 for ; Wed, 26 Aug 2020 15:16:20 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6FB8E2078D for ; Wed, 26 Aug 2020 15:16:20 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="UJqD/t3W" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6FB8E2078D Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 869656B006C; Wed, 26 Aug 2020 11:16:19 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 7C7AB6B0070; Wed, 26 Aug 2020 11:16:19 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6DFFB8D0001; Wed, 26 Aug 2020 11:16:19 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0101.hostedemail.com [216.40.44.101]) by kanga.kvack.org (Postfix) with ESMTP id 58B076B006C for ; Wed, 26 Aug 2020 11:16:19 -0400 (EDT) Received: from smtpin12.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 05B21363B for ; Wed, 26 Aug 2020 15:16:19 +0000 (UTC) X-FDA: 77193070878.12.value25_07096bb27065 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin12.hostedemail.com (Postfix) with ESMTP id E2C0C1801C9BE for ; Wed, 26 Aug 2020 15:15:40 +0000 (UTC) X-Spam-Summary: 1,0,0,8db81f950eb0c33f,d41d8cd98f00b204,3mxxgxwukckwvmzztsaasxq.oayxuzgj-yywhmow.ads@flex--jannh.bounces.google.com,,RULES_HIT:41:69:152:355:379:541:800:960:966:973:981:988:989:1260:1277:1313:1314:1345:1359:1437:1516:1518:1535:1544:1593:1594:1711:1730:1747:1777:1792:2196:2199:2393:2559:2562:2693:2898:2899:3138:3139:3140:3141:3142:3152:3355:3865:3866:3867:3868:3870:3871:3872:3874:4118:4250:4321:4385:4605:5007:6261:6653:7875:7903:7974:8660:9592:9969:10004:11026:11473:11658:11914:12043:12291:12296:12297:12438:12555:12683:12895:12986:13148:13230:13255:14096:14097:14181:14394:14659:14721:21080:21444:21627:21795:21939:21990:30003:30012:30051:30054:30070,0,RBL:209.85.160.202:@flex--jannh.bounces.google.com:.lbl8.mailshell.net-66.100.201.100 62.18.0.100;04yrf9xey1feofx4gucmjo6q1wcz7ycajtgnhbk1et9oqi3fx69o4cidohh1qb3.qhzg55yuhbcwhanpd8fetck9kb1oiy17czxrtfofawddm8xfw5jrb94k4q3a4rt.g-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,Domai nCache:0 X-HE-Tag: value25_07096bb27065 X-Filterd-Recvd-Size: 7370 Received: from mail-qt1-f202.google.com (mail-qt1-f202.google.com [209.85.160.202]) by imf31.hostedemail.com (Postfix) with ESMTP for ; Wed, 26 Aug 2020 15:15:38 +0000 (UTC) Received: by mail-qt1-f202.google.com with SMTP id r9so1963048qtp.7 for ; Wed, 26 Aug 2020 08:15:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=W92EWp10cYvF5yPv3rgiIaePnIXh3IWgRNGaRIqgcR4=; b=UJqD/t3WSlOOwI6R+bovBLP0sPLAoFd9plz7oxgqCdZWBEXqS068KD0/WN83GUiYro AqMkBXVc1ZQW++VdRzH7wzupdkHlEeE8WdNHPNXIrAtApBfg/kUBE5w1O/QJ4oIRh7tV tb02uam4svDcll5gPdChagNY8GeENR2JwPo3cAmCZl9l0lPaA3lpuWAHtoTTZ/nY0xe3 4n3EawWNVxHzX152yi+B+/xnFeZCesLvBc+9Yf0k6A6nYtvt0Cp/3xSdFHsZ6DIr3vdE P/v6YEhnOufPrYUBJwGNBZiHQ38brTulw+gui8aHniQAc42zBTvr/aWwOPvwZ19EuwvR oVxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=W92EWp10cYvF5yPv3rgiIaePnIXh3IWgRNGaRIqgcR4=; b=YHDlUSa9G7PIzenN8wFjezAmIV9DelwHQDoaZUwMuA6Nt/jZcAPyV/KrgfsafkcUjH hYhRFKWATMxjl5jag1S2JRcO1X91oN4b+SqXKp/w9PwycZjfVU0yH76fR2zQtJzbKHaI BGOkTMuvgLRzYiWhD7fKedSZD6m6mXxpcjuSUuMs4vpnJ89l4gzQULmK1o5GYujq/q2S VVvjPghZNCLDIBVqWZNsfauYh3JPplIm16d3K/87fYLqoMyytrjBbvtAmKmXrKQ6NjOe Bq+QUYWYR+96yG5mVttSHHEBPb7gPJkh2XwNo1Mu4U/T+ymXeMC7hW5OsbqmKBaVceOf M3xg== X-Gm-Message-State: AOAM530bcJTN0n4lDVsQzGva8BRconTtNEXqjMYj6xig4uMM8rZgo7iP qiGI2VfDgDM2EgxtLyA+XsEvFm5s7Q== X-Google-Smtp-Source: ABdhPJy7KDIKhCfICG40CVPo7QPb4NhJBMI2xLLuMFSRNzJ90NFTZ37qbydNf49iDwWC0KeljzXzUWr8og== X-Received: from jannh2.zrh.corp.google.com ([2a00:79e0:1b:201:1a60:24ff:fea6:bf44]) (user=jannh job=sendgmr) by 2002:ad4:46ac:: with SMTP id br12mr14699313qvb.236.1598454937463; Wed, 26 Aug 2020 08:15:37 -0700 (PDT) Date: Wed, 26 Aug 2020 17:14:44 +0200 In-Reply-To: <20200826151448.3404695-1-jannh@google.com> Message-Id: <20200826151448.3404695-2-jannh@google.com> Mime-Version: 1.0 References: <20200826151448.3404695-1-jannh@google.com> X-Mailer: git-send-email 2.28.0.297.g1956fa8f8d-goog Subject: [PATCH v4 1/5] binfmt_elf_fdpic: Stop using dump_emit() on user pointers on !MMU From: Jann Horn To: Andrew Morton Cc: Linus Torvalds , Christoph Hellwig , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, Alexander Viro , "Eric W . Biederman" , Oleg Nesterov X-Rspamd-Queue-Id: E2C0C1801C9BE X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam05 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: dump_emit() is for kernel pointers, and VMAs describe userspace memory. Let's be tidy here and avoid accessing userspace pointers under KERNEL_DS, even if it probably doesn't matter much on !MMU systems - especially given that it looks like we can just use the same get_dump_page() as on MMU if we move it out of the CONFIG_MMU block. One small change we have to make in get_dump_page() is to use __get_user_pages_locked() instead of __get_user_pages(), since the latter doesn't exist on nommu. On mmu builds, __get_user_pages_locked() will just call __get_user_pages() for us. Signed-off-by: Jann Horn --- fs/binfmt_elf_fdpic.c | 8 ------ mm/gup.c | 57 +++++++++++++++++++++---------------------- 2 files changed, 28 insertions(+), 37 deletions(-) diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c index 50f845702b92..a53f83830986 100644 --- a/fs/binfmt_elf_fdpic.c +++ b/fs/binfmt_elf_fdpic.c @@ -1529,14 +1529,11 @@ static bool elf_fdpic_dump_segments(struct coredump_params *cprm) struct vm_area_struct *vma; for (vma = current->mm->mmap; vma; vma = vma->vm_next) { -#ifdef CONFIG_MMU unsigned long addr; -#endif if (!maydump(vma, cprm->mm_flags)) continue; -#ifdef CONFIG_MMU for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) { bool res; @@ -1552,11 +1549,6 @@ static bool elf_fdpic_dump_segments(struct coredump_params *cprm) if (!res) return false; } -#else - if (!dump_emit(cprm, (void *) vma->vm_start, - vma->vm_end - vma->vm_start)) - return false; -#endif } return true; } diff --git a/mm/gup.c b/mm/gup.c index ae096ea7583f..92519e5a44b3 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1495,35 +1495,6 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors) mmap_read_unlock(mm); return ret; /* 0 or negative error code */ } - -/** - * get_dump_page() - pin user page in memory while writing it to core dump - * @addr: user address - * - * Returns struct page pointer of user page pinned for dump, - * to be freed afterwards by put_page(). - * - * Returns NULL on any kind of failure - a hole must then be inserted into - * the corefile, to preserve alignment with its headers; and also returns - * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found - - * allowing a hole to be left in the corefile to save diskspace. - * - * Called without mmap_lock, but after all other threads have been killed. - */ -#ifdef CONFIG_ELF_CORE -struct page *get_dump_page(unsigned long addr) -{ - struct vm_area_struct *vma; - struct page *page; - - if (__get_user_pages(current->mm, addr, 1, - FOLL_FORCE | FOLL_DUMP | FOLL_GET, &page, &vma, - NULL) < 1) - return NULL; - flush_cache_page(vma, addr, page_to_pfn(page)); - return page; -} -#endif /* CONFIG_ELF_CORE */ #else /* CONFIG_MMU */ static long __get_user_pages_locked(struct mm_struct *mm, unsigned long start, unsigned long nr_pages, struct page **pages, @@ -1569,6 +1540,34 @@ static long __get_user_pages_locked(struct mm_struct *mm, unsigned long start, } #endif /* !CONFIG_MMU */ +/** + * get_dump_page() - pin user page in memory while writing it to core dump + * @addr: user address + * + * Returns struct page pointer of user page pinned for dump, + * to be freed afterwards by put_page(). + * + * Returns NULL on any kind of failure - a hole must then be inserted into + * the corefile, to preserve alignment with its headers; and also returns + * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found - + * allowing a hole to be left in the corefile to save diskspace. + * + * Called without mmap_lock, but after all other threads have been killed. + */ +#ifdef CONFIG_ELF_CORE +struct page *get_dump_page(unsigned long addr) +{ + struct vm_area_struct *vma; + struct page *page; + + if (__get_user_pages_locked(current->mm, addr, 1, &page, &vma, NULL, + FOLL_FORCE | FOLL_DUMP | FOLL_GET) < 1) + return NULL; + flush_cache_page(vma, addr, page_to_pfn(page)); + return page; +} +#endif /* CONFIG_ELF_CORE */ + #if defined(CONFIG_FS_DAX) || defined (CONFIG_CMA) static bool check_dax_vmas(struct vm_area_struct **vmas, long nr_pages) { From patchwork Wed Aug 26 15:14:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 11738971 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 59B1B1731 for ; Wed, 26 Aug 2020 15:16:23 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 25BFB2075E for ; Wed, 26 Aug 2020 15:16:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="kI/DmR2c" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 25BFB2075E Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id BC30E6B0071; Wed, 26 Aug 2020 11:16:21 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id B736F8D0001; Wed, 26 Aug 2020 11:16:21 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A3FFE6B0073; Wed, 26 Aug 2020 11:16:21 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0047.hostedemail.com [216.40.44.47]) by kanga.kvack.org (Postfix) with ESMTP id 891BB6B0071 for ; Wed, 26 Aug 2020 11:16:21 -0400 (EDT) Received: from smtpin21.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 519413644 for ; Wed, 26 Aug 2020 15:16:21 +0000 (UTC) X-FDA: 77193070962.21.balls99_3e0647927065 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin21.hostedemail.com (Postfix) with ESMTP id B3BA9180442FB for ; Wed, 26 Aug 2020 15:15:42 +0000 (UTC) X-Spam-Summary: 1,0,0,9a9910d3aabf1838,d41d8cd98f00b204,3nxxgxwukclazqddxweewbu.secbydkn-ccalqsa.ehw@flex--jannh.bounces.google.com,,RULES_HIT:41:69:152:355:379:541:800:960:973:988:989:1260:1277:1313:1314:1345:1359:1437:1516:1518:1534:1541:1593:1594:1711:1730:1747:1777:1792:2393:2559:2562:3138:3139:3140:3141:3142:3152:3352:3865:3867:3868:3872:3874:4321:5007:6261:6653:7903:9969:10004:10400:11658:11914:12043:12296:12297:12555:12895:13069:13311:13357:14096:14097:14181:14394:14659:14721:21080:21444:21627:21990:30054,0,RBL:209.85.219.202:@flex--jannh.bounces.google.com:.lbl8.mailshell.net-62.18.0.100 66.100.201.100;04y8541zp3qi14t4dbne39xneh3ktypmh9stjrzsgx6no5der1j4eaxgo3aoeom.wgjyyf9s81oicmxw3kn9basdjncwmu8fpwoeay7w8rpckzwryq7f6yjqbbx891k.w-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:24,LUA_SUMMARY:none X-HE-Tag: balls99_3e0647927065 X-Filterd-Recvd-Size: 4195 Received: from mail-yb1-f202.google.com (mail-yb1-f202.google.com [209.85.219.202]) by imf18.hostedemail.com (Postfix) with ESMTP for ; Wed, 26 Aug 2020 15:15:41 +0000 (UTC) Received: by mail-yb1-f202.google.com with SMTP id g127so3177777ybf.11 for ; Wed, 26 Aug 2020 08:15:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=nVHuYaY9UtfQ5ceDG+IOgNARKDklUVVN28+71pW1fmk=; b=kI/DmR2cv1d9OJFdhnImUqHSGWV1ZqxdGqYUbrFMzIZoLjyBZUGrKg8nscJM4NLWSq aoE+SNTNoDERTGQQ81Jv2cVwHVUyQF4rCSPCBrfHjuNwC0mrKkXcOif6H4GqJ3ObCD1W ehHwAGA7xggv+ecKbvq/e9V08q0y/RhTUILd/sit7XJxc7N/40Scp5dgnxPvQs6qrvIc 79svxj8OV2XyIQ/z/HVb3yBer3F95VUgY2wiLnnZkGmA8ejGcBjzRg0W57SvZTtUh/lg tHZ2FutPYjZ60wnBdq/W3QSQ7XEECKopv3MAPfeOlE+Y2386UV58ZZUOqTacbwL3yjIs jL8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=nVHuYaY9UtfQ5ceDG+IOgNARKDklUVVN28+71pW1fmk=; b=pC5nsznHWPpMWnht4VK2BcOBmvDJWOSlhrUiW1NANa/WuPG9UMuhOTjfA6cr8liWJr KLHFsJfhADMPyvO75kUbSDcBBx7/Xw6qb98RUMXGpK/yF2doIC17MhlCAP/TAx+nfHUC erk0znsaZQX7iDw8JRlugchaSyxLm5zhUq3Wp6y+va79jRYExkBwVrUh07qHHZtObZvC jFnabL6bb8qJTmKbmK96wZYbtKdM0rHmEg7E6vff3hrjP7OaGhDUlozt3lRduMWiTTO8 hX8KwyvfXK6Kqjp4ErM6VjeWdRxpzM2grfk4d1GKoUe3x/MzMys+RdkTOXVt/Zd+Wj7O JFyQ== X-Gm-Message-State: AOAM53135MYfKi75tuIF6FTHflBdglXNiCeT8OLs/Ll1TVUKOfuMhZ3L 9BTXY2duvxZB3xKX7L6NDy4iJyE4TA== X-Google-Smtp-Source: ABdhPJw/rcqGxzh/fmBX9LEz09Jq8CAXmzs2q38x7tBY1D1+LTR0sUBBqdFxw+NulLkgSDFNyvsboxvOcQ== X-Received: from jannh2.zrh.corp.google.com ([2a00:79e0:1b:201:1a60:24ff:fea6:bf44]) (user=jannh job=sendgmr) by 2002:a25:3cc3:: with SMTP id j186mr21293924yba.208.1598454941009; Wed, 26 Aug 2020 08:15:41 -0700 (PDT) Date: Wed, 26 Aug 2020 17:14:45 +0200 In-Reply-To: <20200826151448.3404695-1-jannh@google.com> Message-Id: <20200826151448.3404695-3-jannh@google.com> Mime-Version: 1.0 References: <20200826151448.3404695-1-jannh@google.com> X-Mailer: git-send-email 2.28.0.297.g1956fa8f8d-goog Subject: [PATCH v4 2/5] coredump: Let dump_emit() bail out on short writes From: Jann Horn To: Andrew Morton Cc: Linus Torvalds , Christoph Hellwig , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, Alexander Viro , "Eric W . Biederman" , Oleg Nesterov X-Rspamd-Queue-Id: B3BA9180442FB X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam02 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: dump_emit() has a retry loop, but there seems to be no way for that retry logic to actually be used; and it was also buggy, writing the same data repeatedly after a short write. Let's just bail out on a short write. Suggested-by: Linus Torvalds Signed-off-by: Jann Horn --- fs/coredump.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/fs/coredump.c b/fs/coredump.c index 76e7c10edfc0..5e24c06092c9 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -840,17 +840,17 @@ int dump_emit(struct coredump_params *cprm, const void *addr, int nr) ssize_t n; if (cprm->written + nr > cprm->limit) return 0; - while (nr) { - if (dump_interrupted()) - return 0; - n = __kernel_write(file, addr, nr, &pos); - if (n <= 0) - return 0; - file->f_pos = pos; - cprm->written += n; - cprm->pos += n; - nr -= n; - } + + + if (dump_interrupted()) + return 0; + n = __kernel_write(file, addr, nr, &pos); + if (n != nr) + return 0; + file->f_pos = pos; + cprm->written += n; + cprm->pos += n; + return 1; } EXPORT_SYMBOL(dump_emit); From patchwork Wed Aug 26 15:14:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 11738959 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2D619109B for ; Wed, 26 Aug 2020 15:15:56 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id EE7002054F for ; Wed, 26 Aug 2020 15:15:55 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="EJaKPT+x" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EE7002054F Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 3D1DE6B0030; Wed, 26 Aug 2020 11:15:55 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 3832E6B0031; Wed, 26 Aug 2020 11:15:55 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 29CBE8D0001; Wed, 26 Aug 2020 11:15:55 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0241.hostedemail.com [216.40.44.241]) by kanga.kvack.org (Postfix) with ESMTP id 142D16B0030 for ; Wed, 26 Aug 2020 11:15:55 -0400 (EDT) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id D13FE8249980 for ; Wed, 26 Aug 2020 15:15:54 +0000 (UTC) X-FDA: 77193069828.28.pan59_0c09f0b27065 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin28.hostedemail.com (Postfix) with ESMTP id 1C9EF6C3B for ; Wed, 26 Aug 2020 15:15:47 +0000 (UTC) X-Spam-Summary: 1,0,0,66eaece4c109a92b,d41d8cd98f00b204,3ohxgxwukclmctggazhhzex.vhfebgnq-ffdotvd.hkz@flex--jannh.bounces.google.com,,RULES_HIT:41:69:152:355:379:541:800:960:973:988:989:1260:1277:1313:1314:1345:1359:1437:1516:1518:1535:1544:1593:1594:1711:1730:1747:1777:1792:2393:2559:2562:2898:3138:3139:3140:3141:3142:3152:3354:3865:3866:3867:3868:3872:3874:4118:4321:4605:5007:6261:6653:7974:9592:9969:10004:11026:11473:11658:11914:12043:12291:12294:12296:12297:12438:12555:12683:12895:12986:14096:14097:14110:14181:14394:14659:14721:21080:21444:21627:21990:30003:30054:30070,0,RBL:209.85.218.73:@flex--jannh.bounces.google.com:.lbl8.mailshell.net-62.18.0.100 66.100.201.100;04y8cqszd77zfwm3ougrohmjyyckmoc394ch9k9ts5ufg9zkbfmmf9aq39er6kc.bqzm16sqznfpncbbqayeeusx9eqrkanjz7bbnzxfabe1b9cuydeebhyia3thfcp.4-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:22,LUA_SUMMARY:non e X-HE-Tag: pan59_0c09f0b27065 X-Filterd-Recvd-Size: 7094 Received: from mail-ej1-f73.google.com (mail-ej1-f73.google.com [209.85.218.73]) by imf30.hostedemail.com (Postfix) with ESMTP for ; Wed, 26 Aug 2020 15:15:46 +0000 (UTC) Received: by mail-ej1-f73.google.com with SMTP id gf10so1125616ejb.12 for ; Wed, 26 Aug 2020 08:15:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=37TD1tOgbExZK4EAyJ2auNMattkG66IuBeoEm2InRhU=; b=EJaKPT+xdclNdzHyydB1wtD1f+JDKjLl0qDGYs/FfexMadEImdY6NbC9BpnQwNrpHM LkUSZYbx+9RUly980dt+z2mRNdOG3IbnwGhnUj4glyILCZ0N/jYte6+8NS03h1RlX0rd r3CIvAT8ajv3eqk1/JhxLYJIpzv+WTIYy/s8nkt7JCLLVf+OzXJ4bU+ZJ6YOy5JMa0Bk dXb+vpQGMQ5fMAY6yR2HvUUdC5QYsUzGd5rj4FciLVfkj7Tk8ky3X2ORz+eBuBCOUFkK T4TQvr1uvJ3sLQaCBbckv5jnLmhBWKh9jmcLxktaFyzUL50NN/IE0SwiX2wWUc7MHUtk MSig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=37TD1tOgbExZK4EAyJ2auNMattkG66IuBeoEm2InRhU=; b=cwDC4G40Fp/UrNCiD+yneOdhK7hyGPkvsK138tXdXeq4q99Q9W1f8x3gUnHKvnP4mn YvXv+MCDO1x9iJiyUZ3guwU3gO9bImg6IApHLo44GAdSo9ipHo3Ba28LNcHKjXTx2P9V tofKq6KzlgeSzamf/IGhbb9UCzoSLHs5+7HEj4PV91ll9+tMZF/z7yEhHSXX9y+lHPs2 rZktr947ZrWwdIkhIIFjmf5Hf+4rrpaYsiO8Ov2IJ9sP7qxJ9bzoVwRNoBCuGnEqHC8M AMmhiG66zwhxZwDaYQKNaFF/0PCs3gDHAgB5pRna3XEkxEUfUexI6Te5dg9fDtfRXWMs 17dw== X-Gm-Message-State: AOAM530BdbWYi4f40rqB9ocen8WH2tx8FKq2n1Coo8T1zY/Mbmbeh23V rvGbOHs+GdLwrYgrkZCvKP6CIuMWPQ== X-Google-Smtp-Source: ABdhPJzt8BeQRY53dXQK6w4X+lfLoMxsOd+cnH57xkDOTHWo+hlkWgtx2J1Byi3ymA4q0Sa382PLimiVAw== X-Received: from jannh2.zrh.corp.google.com ([2a00:79e0:1b:201:1a60:24ff:fea6:bf44]) (user=jannh job=sendgmr) by 2002:a50:fe17:: with SMTP id f23mr13811629edt.364.1598454944949; Wed, 26 Aug 2020 08:15:44 -0700 (PDT) Date: Wed, 26 Aug 2020 17:14:46 +0200 In-Reply-To: <20200826151448.3404695-1-jannh@google.com> Message-Id: <20200826151448.3404695-4-jannh@google.com> Mime-Version: 1.0 References: <20200826151448.3404695-1-jannh@google.com> X-Mailer: git-send-email 2.28.0.297.g1956fa8f8d-goog Subject: [PATCH v4 3/5] coredump: Refactor page range dumping into common helper From: Jann Horn To: Andrew Morton Cc: Linus Torvalds , Christoph Hellwig , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, Alexander Viro , "Eric W . Biederman" , Oleg Nesterov X-Rspamd-Queue-Id: 1C9EF6C3B X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam01 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Both fs/binfmt_elf.c and fs/binfmt_elf_fdpic.c need to dump ranges of pages into the coredump file. Extract that logic into a common helper. Signed-off-by: Jann Horn --- fs/binfmt_elf.c | 22 ++-------------------- fs/binfmt_elf_fdpic.c | 18 +++--------------- fs/coredump.c | 34 ++++++++++++++++++++++++++++++++++ include/linux/coredump.h | 2 ++ 4 files changed, 41 insertions(+), 35 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 13d053982dd7..5fd11a25d320 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -2419,26 +2419,8 @@ static int elf_core_dump(struct coredump_params *cprm) for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; vma = next_vma(vma, gate_vma)) { - unsigned long addr; - unsigned long end; - - end = vma->vm_start + vma_filesz[i++]; - - for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { - struct page *page; - int stop; - - page = get_dump_page(addr); - if (page) { - void *kaddr = kmap(page); - stop = !dump_emit(cprm, kaddr, PAGE_SIZE); - kunmap(page); - put_page(page); - } else - stop = !dump_skip(cprm, PAGE_SIZE); - if (stop) - goto end_coredump; - } + if (!dump_user_range(cprm, vma->vm_start, vma_filesz[i++])) + goto end_coredump; } dump_truncate(cprm); diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c index a53f83830986..76e8c0defdc8 100644 --- a/fs/binfmt_elf_fdpic.c +++ b/fs/binfmt_elf_fdpic.c @@ -1534,21 +1534,9 @@ static bool elf_fdpic_dump_segments(struct coredump_params *cprm) if (!maydump(vma, cprm->mm_flags)) continue; - for (addr = vma->vm_start; addr < vma->vm_end; - addr += PAGE_SIZE) { - bool res; - struct page *page = get_dump_page(addr); - if (page) { - void *kaddr = kmap(page); - res = dump_emit(cprm, kaddr, PAGE_SIZE); - kunmap(page); - put_page(page); - } else { - res = dump_skip(cprm, PAGE_SIZE); - } - if (!res) - return false; - } + if (!dump_user_range(cprm, vma->vm_start, + vma->vma_end - vma->vm_start)) + return false; } return true; } diff --git a/fs/coredump.c b/fs/coredump.c index 5e24c06092c9..6042d15acd51 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -876,6 +876,40 @@ int dump_skip(struct coredump_params *cprm, size_t nr) } EXPORT_SYMBOL(dump_skip); +#ifdef CONFIG_ELF_CORE +int dump_user_range(struct coredump_params *cprm, unsigned long start, + unsigned long len) +{ + unsigned long addr; + + for (addr = start; addr < start + len; addr += PAGE_SIZE) { + struct page *page; + int stop; + + /* + * To avoid having to allocate page tables for virtual address + * ranges that have never been used yet, and also to make it + * easy to generate sparse core files, use a helper that returns + * NULL when encountering an empty page table entry that would + * otherwise have been filled with the zero page. + */ + page = get_dump_page(addr); + if (page) { + void *kaddr = kmap(page); + + stop = !dump_emit(cprm, kaddr, PAGE_SIZE); + kunmap(page); + put_page(page); + } else { + stop = !dump_skip(cprm, PAGE_SIZE); + } + if (stop) + return 0; + } + return 1; +} +#endif + int dump_align(struct coredump_params *cprm, int align) { unsigned mod = cprm->pos & (align - 1); diff --git a/include/linux/coredump.h b/include/linux/coredump.h index 7a899e83835d..f0b71a74d0bc 100644 --- a/include/linux/coredump.h +++ b/include/linux/coredump.h @@ -16,6 +16,8 @@ extern int dump_skip(struct coredump_params *cprm, size_t nr); extern int dump_emit(struct coredump_params *cprm, const void *addr, int nr); extern int dump_align(struct coredump_params *cprm, int align); extern void dump_truncate(struct coredump_params *cprm); +int dump_user_range(struct coredump_params *cprm, unsigned long start, + unsigned long len); #ifdef CONFIG_COREDUMP extern void do_coredump(const kernel_siginfo_t *siginfo); #else From patchwork Wed Aug 26 15:14:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 11738967 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BF79C109B for ; Wed, 26 Aug 2020 15:16:16 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6454D2075E for ; Wed, 26 Aug 2020 15:16:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="NSImDiEg" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6454D2075E Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 9292D6B0055; Wed, 26 Aug 2020 11:16:15 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 8DB706B005C; Wed, 26 Aug 2020 11:16:15 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7CAAA8D0001; Wed, 26 Aug 2020 11:16:15 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0022.hostedemail.com [216.40.44.22]) by kanga.kvack.org (Postfix) with ESMTP id 623E76B0055 for ; Wed, 26 Aug 2020 11:16:15 -0400 (EDT) Received: from smtpin02.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 1E47F181AEF00 for ; Wed, 26 Aug 2020 15:16:15 +0000 (UTC) X-FDA: 77193070710.02.nest43_3c0086e27065 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin02.hostedemail.com (Postfix) with ESMTP id BBD2310097ACF for ; Wed, 26 Aug 2020 15:15:55 +0000 (UTC) X-Spam-Summary: 1,0,0,f631b1a1946a9299,d41d8cd98f00b204,3phxgxwukclcgxkkedlldib.zljifkru-jjhsxzh.lod@flex--jannh.bounces.google.com,,RULES_HIT:41:69:152:327:355:379:541:800:960:966:973:988:989:1260:1277:1313:1314:1345:1359:1431:1437:1516:1518:1593:1594:1605:1730:1747:1777:1792:2196:2198:2199:2200:2393:2553:2559:2562:2693:2892:2898:3138:3139:3140:3141:3142:3152:3865:3866:3867:3868:3870:3871:3872:3873:3874:4250:4321:4385:4605:5007:6119:6261:6653:7875:7903:7974:8603:9010:9012:9592:9969:10004:10226:10954:11026:11232:11473:11658:11914:12043:12291:12294:12296:12297:12438:12555:12663:12683:12895:12986:13149:13230:13869:13972:14096:14097:14394:14659:21080:21220:21222:21324:21325:21444:21450:21451:21611:21627:21939:21983:21987:21990:30005:30012:30034:30045:30051:30054:30070:30075:30090,0,RBL:209.85.208.73:@flex--jannh.bounces.google.com:.lbl8.mailshell.net-62.18.84.100 66.100.201.100;04yfmd4iufb9n4anabw49ym37gj6dypydepgz553w55ewwde89jwd1ihzfeucqt.ia75kji3qw71kujppj4p8izcboihm3f9u41swa utnxkape X-HE-Tag: nest43_3c0086e27065 X-Filterd-Recvd-Size: 21154 Received: from mail-ed1-f73.google.com (mail-ed1-f73.google.com [209.85.208.73]) by imf33.hostedemail.com (Postfix) with ESMTP for ; Wed, 26 Aug 2020 15:15:49 +0000 (UTC) Received: by mail-ed1-f73.google.com with SMTP id dd25so801916edb.6 for ; Wed, 26 Aug 2020 08:15:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=U5oj/SuEX7HYHFTd45A2bSCZ+x4rBEIL/DUrQ9ebWks=; b=NSImDiEgLQ0bgRY4/KrsGxkzN/U0wLAlmkemNE384qFQtpy4Spgr8MhbEdeBOQfgEK R3X98rtjMrSzY0BNoREqe37Ryk5VV/n4QaEHZU36qW6vuVUJka5OpKJpyY/4D2GZakBb Huh/P4VGBX2INCv1K7Z0VXVYWTaXobFUKHN82kdm/dC0Zd9XiuujO4xq0m1aCvHVdHHj 1azbPCKkg/rA2YwkRgU9blz0PBT2BX6kY6A1xDJwJxxs8KkVQkG1+whPRC8wGMJOFqJG /g0JWseOc6ZT9IR5bEaAvgYWxxmjH9OuPW6P58fxdeIr7uxoii7euDYPj8A5WpXAaeza /PzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=U5oj/SuEX7HYHFTd45A2bSCZ+x4rBEIL/DUrQ9ebWks=; b=oLY/1dime30JuUX+0V+eM65V7+BxE6UYoauANCPIWo/y9KbWHMQ1HSLfAJNWAQ9fi+ Ek6kO40sCWccalYpdSUNpWma2OUYynqzfXQWU30gW3WWXAVPxyyt/AvkkjQ6Yt86W1ix NYR9avZRoTQIEnzV1EisoVdd2Yrt6/GPRf0nJ+/01EUOdKD5BY1DjpnFqlTfeKM0J7Hh +9AAesynwVp8v03SGdbeCTeNT21Gaw0GVV/MWaUJ9PKF4yT/J2n3VQxjn9VvuUCje6iz iOY0ngiywaOzcsu9zYw0cXHQmfJvor0HQjLlXFG/ptp4c/gcPhfl5sCYEbCKVgDfM3Sl UIgA== X-Gm-Message-State: AOAM5330pwDRMLXLRVCf6G/AWGR2JQ6JDJrqizMGdiANkj1H13X9uqWR zy8tXoVEeW4GRNsOtDTQxKaa17+KDw== X-Google-Smtp-Source: ABdhPJywN3pTPoKXUDJMuJIPHM7NTMPQXJJQymyhGbSaCPwsrC8rZwgZGcBVv7T5X7zDqQgfPsCsNB1p0w== X-Received: from jannh2.zrh.corp.google.com ([2a00:79e0:1b:201:1a60:24ff:fea6:bf44]) (user=jannh job=sendgmr) by 2002:aa7:c6d1:: with SMTP id b17mr15647774eds.336.1598454948791; Wed, 26 Aug 2020 08:15:48 -0700 (PDT) Date: Wed, 26 Aug 2020 17:14:47 +0200 In-Reply-To: <20200826151448.3404695-1-jannh@google.com> Message-Id: <20200826151448.3404695-5-jannh@google.com> Mime-Version: 1.0 References: <20200826151448.3404695-1-jannh@google.com> X-Mailer: git-send-email 2.28.0.297.g1956fa8f8d-goog Subject: [PATCH v4 4/5] binfmt_elf, binfmt_elf_fdpic: Use a VMA list snapshot From: Jann Horn To: Andrew Morton Cc: Linus Torvalds , Christoph Hellwig , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, Alexander Viro , "Eric W . Biederman" , Oleg Nesterov X-Rspamd-Queue-Id: BBD2310097ACF X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam03 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: In both binfmt_elf and binfmt_elf_fdpic, use a new helper dump_vma_snapshot() to take a snapshot of the VMA list (including the gate VMA, if we have one) while protected by the mmap_lock, and then use that snapshot instead of walking the VMA list without locking. An alternative approach would be to keep the mmap_lock held across the entire core dumping operation; however, keeping the mmap_lock locked while we may be blocked for an unbounded amount of time (e.g. because we're dumping to a FUSE filesystem or so) isn't really optimal; the mmap_lock blocks things like the ->release handler of userfaultfd, and we don't really want critical system daemons to grind to a halt just because someone "gifted" them SCM_RIGHTS to an eternally-locked userfaultfd, or something like that. Since both the normal ELF code and the FDPIC ELF code need this functionality (and if any other binfmt wants to add coredump support in the future, they'd probably need it, too), implement this with a common helper in fs/coredump.c. A downside of this approach is that we now need a bigger amount of kernel memory per userspace VMA in the normal ELF case, and that we need O(n) kernel memory in the FDPIC ELF case at all; but 40 bytes per VMA shouldn't be terribly bad. Signed-off-by: Jann Horn --- fs/binfmt_elf.c | 129 +++++++++------------------------------ fs/binfmt_elf_fdpic.c | 86 +++++++++++++------------- fs/coredump.c | 69 +++++++++++++++++++++ include/linux/coredump.h | 9 +++ 4 files changed, 148 insertions(+), 145 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 5fd11a25d320..0585794400a4 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -1475,31 +1475,13 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, goto whole; /* - * If this looks like the beginning of a DSO or executable mapping, - * check for an ELF header. If we find one, dump the first page to - * aid in determining what was mapped here. + * If this is the beginning of an executable file mapping, + * dump the first page to aid in determining what was mapped here. */ if (FILTER(ELF_HEADERS) && - vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { - u32 __user *header = (u32 __user *) vma->vm_start; - u32 word; - /* - * Doing it this way gets the constant folded by GCC. - */ - union { - u32 cmp; - char elfmag[SELFMAG]; - } magic; - BUILD_BUG_ON(SELFMAG != sizeof word); - magic.elfmag[EI_MAG0] = ELFMAG0; - magic.elfmag[EI_MAG1] = ELFMAG1; - magic.elfmag[EI_MAG2] = ELFMAG2; - magic.elfmag[EI_MAG3] = ELFMAG3; - if (unlikely(get_user(word, header))) - word = 0; - if (word == magic.cmp) - return PAGE_SIZE; - } + vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ) && + (READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) != 0) + return PAGE_SIZE; #undef FILTER @@ -2220,32 +2202,6 @@ static void free_note_info(struct elf_note_info *info) #endif -static struct vm_area_struct *first_vma(struct task_struct *tsk, - struct vm_area_struct *gate_vma) -{ - struct vm_area_struct *ret = tsk->mm->mmap; - - if (ret) - return ret; - return gate_vma; -} -/* - * Helper function for iterating across a vma list. It ensures that the caller - * will visit `gate_vma' prior to terminating the search. - */ -static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, - struct vm_area_struct *gate_vma) -{ - struct vm_area_struct *ret; - - ret = this_vma->vm_next; - if (ret) - return ret; - if (this_vma == gate_vma) - return NULL; - return gate_vma; -} - static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, elf_addr_t e_shoff, int segs) { @@ -2272,9 +2228,8 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, static int elf_core_dump(struct coredump_params *cprm) { int has_dumped = 0; - int segs, i; + int vma_count, segs, i; size_t vma_data_size = 0; - struct vm_area_struct *vma, *gate_vma; struct elfhdr elf; loff_t offset = 0, dataoff; struct elf_note_info info = { }; @@ -2282,30 +2237,19 @@ static int elf_core_dump(struct coredump_params *cprm) struct elf_shdr *shdr4extnum = NULL; Elf_Half e_phnum; elf_addr_t e_shoff; - elf_addr_t *vma_filesz = NULL; + struct core_vma_metadata *vma_meta; + + if (dump_vma_snapshot(cprm, &vma_count, &vma_meta, vma_dump_size)) + return 0; + + for (i = 0; i < vma_count; i++) + vma_data_size += vma_meta[i].dump_size; - /* - * We no longer stop all VM operations. - * - * This is because those proceses that could possibly change map_count - * or the mmap / vma pages are now blocked in do_exit on current - * finishing this core dump. - * - * Only ptrace can touch these memory addresses, but it doesn't change - * the map_count or the pages allocated. So no possibility of crashing - * exists while dumping the mm->vm_next areas to the core file. - */ - /* * The number of segs are recored into ELF header as 16bit value. * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. */ - segs = current->mm->map_count; - segs += elf_core_extra_phdrs(); - - gate_vma = get_gate_vma(current->mm); - if (gate_vma != NULL) - segs++; + segs = vma_count + elf_core_extra_phdrs(); /* for notes section */ segs++; @@ -2343,24 +2287,6 @@ static int elf_core_dump(struct coredump_params *cprm) dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); - /* - * Zero vma process will get ZERO_SIZE_PTR here. - * Let coredump continue for register state at least. - */ - vma_filesz = kvmalloc(array_size(sizeof(*vma_filesz), (segs - 1)), - GFP_KERNEL); - if (!vma_filesz) - goto end_coredump; - - for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; - vma = next_vma(vma, gate_vma)) { - unsigned long dump_size; - - dump_size = vma_dump_size(vma, cprm->mm_flags); - vma_filesz[i++] = dump_size; - vma_data_size += dump_size; - } - offset += vma_data_size; offset += elf_core_extra_data_size(); e_shoff = offset; @@ -2381,21 +2307,23 @@ static int elf_core_dump(struct coredump_params *cprm) goto end_coredump; /* Write program headers for segments dump */ - for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; - vma = next_vma(vma, gate_vma)) { + for (i = 0; i < vma_count; i++) { + struct core_vma_metadata *meta = vma_meta + i; struct elf_phdr phdr; phdr.p_type = PT_LOAD; phdr.p_offset = offset; - phdr.p_vaddr = vma->vm_start; + phdr.p_vaddr = meta->start; phdr.p_paddr = 0; - phdr.p_filesz = vma_filesz[i++]; - phdr.p_memsz = vma->vm_end - vma->vm_start; + phdr.p_filesz = meta->dump_size; + phdr.p_memsz = meta->end - meta->start; offset += phdr.p_filesz; - phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; - if (vma->vm_flags & VM_WRITE) + phdr.p_flags = 0; + if (meta->flags & VM_READ) + phdr.p_flags |= PF_R; + if (meta->flags & VM_WRITE) phdr.p_flags |= PF_W; - if (vma->vm_flags & VM_EXEC) + if (meta->flags & VM_EXEC) phdr.p_flags |= PF_X; phdr.p_align = ELF_EXEC_PAGESIZE; @@ -2417,9 +2345,10 @@ static int elf_core_dump(struct coredump_params *cprm) if (!dump_skip(cprm, dataoff - cprm->pos)) goto end_coredump; - for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; - vma = next_vma(vma, gate_vma)) { - if (!dump_user_range(cprm, vma->vm_start, vma_filesz[i++])) + for (i = 0; i < vma_count; i++) { + struct core_vma_metadata *meta = vma_meta + i; + + if (!dump_user_range(cprm, meta->start, meta->dump_size)) goto end_coredump; } dump_truncate(cprm); @@ -2435,7 +2364,7 @@ static int elf_core_dump(struct coredump_params *cprm) end_coredump: free_note_info(&info); kfree(shdr4extnum); - kvfree(vma_filesz); + kvfree(vma_meta); kfree(phdr4note); return has_dumped; } diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c index 76e8c0defdc8..f9d35bc9f0af 100644 --- a/fs/binfmt_elf_fdpic.c +++ b/fs/binfmt_elf_fdpic.c @@ -1222,7 +1222,8 @@ struct elf_prstatus_fdpic * * I think we should skip something. But I am not sure how. H.J. */ -static int maydump(struct vm_area_struct *vma, unsigned long mm_flags) +static unsigned long vma_dump_size(struct vm_area_struct *vma, + unsigned long mm_flags) { int dump_ok; @@ -1251,7 +1252,7 @@ static int maydump(struct vm_area_struct *vma, unsigned long mm_flags) kdcore("%08lx: %08lx: %s (DAX private)", vma->vm_start, vma->vm_flags, dump_ok ? "yes" : "no"); } - return dump_ok; + goto out; } /* By default, dump shared memory if mapped from an anonymous file. */ @@ -1260,13 +1261,13 @@ static int maydump(struct vm_area_struct *vma, unsigned long mm_flags) dump_ok = test_bit(MMF_DUMP_ANON_SHARED, &mm_flags); kdcore("%08lx: %08lx: %s (share)", vma->vm_start, vma->vm_flags, dump_ok ? "yes" : "no"); - return dump_ok; + goto out; } dump_ok = test_bit(MMF_DUMP_MAPPED_SHARED, &mm_flags); kdcore("%08lx: %08lx: %s (share)", vma->vm_start, vma->vm_flags, dump_ok ? "yes" : "no"); - return dump_ok; + goto out; } #ifdef CONFIG_MMU @@ -1275,14 +1276,16 @@ static int maydump(struct vm_area_struct *vma, unsigned long mm_flags) dump_ok = test_bit(MMF_DUMP_MAPPED_PRIVATE, &mm_flags); kdcore("%08lx: %08lx: %s (!anon)", vma->vm_start, vma->vm_flags, dump_ok ? "yes" : "no"); - return dump_ok; + goto out; } #endif dump_ok = test_bit(MMF_DUMP_ANON_PRIVATE, &mm_flags); kdcore("%08lx: %08lx: %s", vma->vm_start, vma->vm_flags, dump_ok ? "yes" : "no"); - return dump_ok; + +out: + return dump_ok ? vma->vm_end - vma->vm_start : 0; } /* An ELF note in memory */ @@ -1524,31 +1527,30 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, /* * dump the segments for an MMU process */ -static bool elf_fdpic_dump_segments(struct coredump_params *cprm) +static bool elf_fdpic_dump_segments(struct coredump_params *cprm, + struct core_vma_metadata *vma_meta, + int vma_count) { - struct vm_area_struct *vma; + int i; - for (vma = current->mm->mmap; vma; vma = vma->vm_next) { - unsigned long addr; + for (i = 0; i < vma_count; i++) { + struct core_vma_metadata *meta = vma_meta + i; - if (!maydump(vma, cprm->mm_flags)) - continue; - - if (!dump_user_range(cprm, vma->vm_start, - vma->vma_end - vma->vm_start)) + if (!dump_user_range(cprm, meta->start, meta->dump_size)) return false; } return true; } -static size_t elf_core_vma_data_size(unsigned long mm_flags) +static size_t elf_core_vma_data_size(unsigned long mm_flags, + struct core_vma_metadata *vma_meta, + int vma_count) { - struct vm_area_struct *vma; size_t size = 0; + int i; - for (vma = current->mm->mmap; vma; vma = vma->vm_next) - if (maydump(vma, mm_flags)) - size += vma->vm_end - vma->vm_start; + for (i = 0; i < vma_count; i++) + size += vma_meta[i].dump_size; return size; } @@ -1562,9 +1564,8 @@ static size_t elf_core_vma_data_size(unsigned long mm_flags) static int elf_fdpic_core_dump(struct coredump_params *cprm) { int has_dumped = 0; - int segs; + int vma_count, segs; int i; - struct vm_area_struct *vma; struct elfhdr *elf = NULL; loff_t offset = 0, dataoff; struct memelfnote psinfo_note, auxv_note; @@ -1578,18 +1579,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) elf_addr_t e_shoff; struct core_thread *ct; struct elf_thread_status *tmp; - - /* - * We no longer stop all VM operations. - * - * This is because those proceses that could possibly change map_count - * or the mmap / vma pages are now blocked in do_exit on current - * finishing this core dump. - * - * Only ptrace can touch these memory addresses, but it doesn't change - * the map_count or the pages allocated. So no possibility of crashing - * exists while dumping the mm->vm_next areas to the core file. - */ + struct core_vma_metadata *vma_meta = NULL; /* alloc memory for large data structures: too large to be on stack */ elf = kmalloc(sizeof(*elf), GFP_KERNEL); @@ -1599,6 +1589,9 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) if (!psinfo) goto end_coredump; + if (dump_vma_snapshot(cprm, &vma_count, &vma_meta, vma_dump_size)) + goto end_coredump; + for (ct = current->mm->core_state->dumper.next; ct; ct = ct->next) { tmp = elf_dump_thread_status(cprm->siginfo->si_signo, @@ -1618,8 +1611,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) tmp->next = thread_list; thread_list = tmp; - segs = current->mm->map_count; - segs += elf_core_extra_phdrs(); + segs = vma_count + elf_core_extra_phdrs(); /* for notes section */ segs++; @@ -1664,7 +1656,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) /* Page-align dumped data */ dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); - offset += elf_core_vma_data_size(cprm->mm_flags); + offset += elf_core_vma_data_size(cprm->mm_flags, vma_meta, vma_count); offset += elf_core_extra_data_size(); e_shoff = offset; @@ -1684,23 +1676,26 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) goto end_coredump; /* write program headers for segments dump */ - for (vma = current->mm->mmap; vma; vma = vma->vm_next) { + for (i = 0; i < vma_count; i++) { + struct core_vma_metadata *meta = vma_meta + i; struct elf_phdr phdr; size_t sz; - sz = vma->vm_end - vma->vm_start; + sz = meta->end - meta->start; phdr.p_type = PT_LOAD; phdr.p_offset = offset; - phdr.p_vaddr = vma->vm_start; + phdr.p_vaddr = meta->start; phdr.p_paddr = 0; - phdr.p_filesz = maydump(vma, cprm->mm_flags) ? sz : 0; + phdr.p_filesz = meta->dump_size; phdr.p_memsz = sz; offset += phdr.p_filesz; - phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; - if (vma->vm_flags & VM_WRITE) + phdr.p_flags = 0; + if (meta->flags & VM_READ) + phdr.p_flags |= PF_R; + if (meta->flags & VM_WRITE) phdr.p_flags |= PF_W; - if (vma->vm_flags & VM_EXEC) + if (meta->flags & VM_EXEC) phdr.p_flags |= PF_X; phdr.p_align = ELF_EXEC_PAGESIZE; @@ -1732,7 +1727,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) if (!dump_skip(cprm, dataoff - cprm->pos)) goto end_coredump; - if (!elf_fdpic_dump_segments(cprm)) + if (!elf_fdpic_dump_segments(cprm, vma_meta, vma_count)) goto end_coredump; if (!elf_core_write_extra_data(cprm)) @@ -1756,6 +1751,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) thread_list = thread_list->next; kfree(tmp); } + kvfree(vma_meta); kfree(phdr4note); kfree(elf); kfree(psinfo); diff --git a/fs/coredump.c b/fs/coredump.c index 6042d15acd51..7b4486b701bb 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -936,3 +936,72 @@ void dump_truncate(struct coredump_params *cprm) } } EXPORT_SYMBOL(dump_truncate); + +static struct vm_area_struct *first_vma(struct task_struct *tsk, + struct vm_area_struct *gate_vma) +{ + struct vm_area_struct *ret = tsk->mm->mmap; + + if (ret) + return ret; + return gate_vma; +} + +/* + * Helper function for iterating across a vma list. It ensures that the caller + * will visit `gate_vma' prior to terminating the search. + */ +static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, + struct vm_area_struct *gate_vma) +{ + struct vm_area_struct *ret; + + ret = this_vma->vm_next; + if (ret) + return ret; + if (this_vma == gate_vma) + return NULL; + return gate_vma; +} + +/* + * Under the mmap_lock, take a snapshot of relevant information about the task's + * VMAs. + */ +int dump_vma_snapshot(struct coredump_params *cprm, int *vma_count, + struct core_vma_metadata **vma_meta, + unsigned long (*dump_size_cb)(struct vm_area_struct *, unsigned long)) +{ + struct vm_area_struct *vma, *gate_vma; + struct mm_struct *mm = current->mm; + int i; + + if (mmap_read_lock_killable(mm)) + return -EINTR; + + gate_vma = get_gate_vma(mm); + *vma_count = mm->map_count + (gate_vma ? 1 : 0); + + *vma_meta = kvmalloc_array(*vma_count, sizeof(**vma_meta), GFP_KERNEL); + if (!*vma_meta) { + mmap_read_unlock(mm); + return -ENOMEM; + } + + for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; + vma = next_vma(vma, gate_vma), i++) { + struct core_vma_metadata *m = (*vma_meta) + i; + + m->start = vma->vm_start; + m->end = vma->vm_end; + m->flags = vma->vm_flags; + m->dump_size = dump_size_cb(vma, cprm->mm_flags); + } + + mmap_read_unlock(mm); + + if (WARN_ON(i != *vma_count)) + return -EFAULT; + + return 0; +} diff --git a/include/linux/coredump.h b/include/linux/coredump.h index f0b71a74d0bc..21bbef9bd8d6 100644 --- a/include/linux/coredump.h +++ b/include/linux/coredump.h @@ -7,6 +7,12 @@ #include #include +struct core_vma_metadata { + unsigned long start, end; + unsigned long flags; + unsigned long dump_size; +}; + /* * These are the only things you should do on a core-file: use only these * functions to write out all the necessary info. @@ -18,6 +24,9 @@ extern int dump_align(struct coredump_params *cprm, int align); extern void dump_truncate(struct coredump_params *cprm); int dump_user_range(struct coredump_params *cprm, unsigned long start, unsigned long len); +int dump_vma_snapshot(struct coredump_params *cprm, int *vma_count, + struct core_vma_metadata **vma_meta, + unsigned long (*dump_size_cb)(struct vm_area_struct *, unsigned long)); #ifdef CONFIG_COREDUMP extern void do_coredump(const kernel_siginfo_t *siginfo); #else From patchwork Wed Aug 26 15:14:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 11738961 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A8056109B for ; Wed, 26 Aug 2020 15:15:59 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 74D532075E for ; Wed, 26 Aug 2020 15:15:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="PZRtl3oE" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 74D532075E Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 83F7F6B0033; Wed, 26 Aug 2020 11:15:58 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 8176F6B0037; Wed, 26 Aug 2020 11:15:58 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 707A18D0001; Wed, 26 Aug 2020 11:15:58 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0143.hostedemail.com [216.40.44.143]) by kanga.kvack.org (Postfix) with ESMTP id 5A5F16B0033 for ; Wed, 26 Aug 2020 11:15:58 -0400 (EDT) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id BE8B73632 for ; Wed, 26 Aug 2020 15:15:57 +0000 (UTC) X-FDA: 77193069954.07.rule30_1b161ce27065 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin07.hostedemail.com (Postfix) with ESMTP id BC95E1803F9BB for ; Wed, 26 Aug 2020 15:15:53 +0000 (UTC) X-Spam-Summary: 1,0,0,f580c51989b9901e,d41d8cd98f00b204,3qhxgxwukclskbooihpphmf.dpnmjovy-nnlwbdl.psh@flex--jannh.bounces.google.com,,RULES_HIT:41:152:355:379:541:800:960:973:981:988:989:1260:1277:1313:1314:1345:1359:1437:1516:1518:1534:1541:1593:1594:1711:1730:1747:1777:1792:2393:2559:2562:2693:3138:3139:3140:3141:3142:3152:3353:3865:3867:3868:3870:3872:4250:4321:4605:5007:6261:6653:7903:9969:10004:10400:11026:11233:11473:11658:11914:12043:12296:12297:12438:12555:12895:13069:13311:13357:14096:14097:14181:14394:14659:14721:21080:21444:21627:21987:21990:30012:30054:30070,0,RBL:209.85.219.73:@flex--jannh.bounces.google.com:.lbl8.mailshell.net-62.18.0.100 66.100.201.100;04yrnbr88r1oo1mxkurixbyo5ue3yyctzfmuur85an99ewp6frqgw8ojhxtwgig.qmo1sck9z4jb7ktm9z978knmg4xsh1sah4tmskjet5kc1obe58u6nw7i7ygcgap.c-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:24,LUA_SUMMARY:none X-HE-Tag: rule30_1b161ce27065 X-Filterd-Recvd-Size: 4626 Received: from mail-qv1-f73.google.com (mail-qv1-f73.google.com [209.85.219.73]) by imf22.hostedemail.com (Postfix) with ESMTP for ; Wed, 26 Aug 2020 15:15:53 +0000 (UTC) Received: by mail-qv1-f73.google.com with SMTP id n5so1817599qvx.2 for ; Wed, 26 Aug 2020 08:15:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=7aZgefibZrTCs6XQP3SSXIsvAQ9RHGTwgc0UHLaNuJc=; b=PZRtl3oEvcUqv3W5Kf6A433P7e2W3tl/mCCy3xK3DV/7P/aXv0u06wYmjDvvZEQWOT ec/yeyDjZzlkcqBgnSCJVm01y8rwgXg0XhozXR3K/Qt+NSPOvhHC8OdoYrSdOhv7TZjP mXNFSgjT8pyGVkBj5APT7WYyRtNTxMfIeHp+vXwRYaP0z6eee2VPXSr30DB6lbnor3YM 18ZIzWMCS3dqI9hPlOsgn5kk4s2gN+rMvTtl9/3sT+zhcVisuexKfn5RTr/4IVWvn76D eiwl+5wyVMCTrHqG84CNQSdNJYTgnxdCwBdzLqSxPpQEE31nmdOkhMePpT4krSphqKqP xYhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=7aZgefibZrTCs6XQP3SSXIsvAQ9RHGTwgc0UHLaNuJc=; b=nPN2QYOaDxdXf//U3Wx+BWknE1aN7D9ulc5C5nuDdiJXDQbW1N0iVzjlmsiwlBts4l GutIoe4va6VWElkK8BMG8xheMyw3owFQzK7cIM6Bj1a/WGjDIB8FVMchcw+cKnvaMV1J t+GrJ6Wj70wB2PGZE2mN2TS7soXDTFzixVt+FZFFEMv/NkCs2vy3VYZlIwLUjPz7TsPu 6DfHCeOjb4YwiW/K+1h+7eY1FcVffAfhFZjWwNT4BQPs6qLcmzv+JofneBfRhxoajSHb pTgcYqQtXqrF7YTzEfJVFbcNeLk1fqy9Kow5izw9G8Lf8uNggZcSgbt0dTQ8p5hzSKvW 4PYA== X-Gm-Message-State: AOAM531H2/jAmHb/nG9brBPhlxaKHWSUjwMFyt5WPHhEpD6Z1UKMoyxl 0ZI2RwuV8YtjHy38LMfJBFjkY+axBg== X-Google-Smtp-Source: ABdhPJzslNHRMbDlTLSVH+ySRuZDYmPvdWgqFZD9I7LbDYlgShjS4rqt60Xa4GlkiwlcHLvW6gI3Hs+U2A== X-Received: from jannh2.zrh.corp.google.com ([2a00:79e0:1b:201:1a60:24ff:fea6:bf44]) (user=jannh job=sendgmr) by 2002:a0c:f4d0:: with SMTP id o16mr14300775qvm.225.1598454952452; Wed, 26 Aug 2020 08:15:52 -0700 (PDT) Date: Wed, 26 Aug 2020 17:14:48 +0200 In-Reply-To: <20200826151448.3404695-1-jannh@google.com> Message-Id: <20200826151448.3404695-6-jannh@google.com> Mime-Version: 1.0 References: <20200826151448.3404695-1-jannh@google.com> X-Mailer: git-send-email 2.28.0.297.g1956fa8f8d-goog Subject: [PATCH v4 5/5] mm/gup: Take mmap_lock in get_dump_page() From: Jann Horn To: Andrew Morton Cc: Linus Torvalds , Christoph Hellwig , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, Alexander Viro , "Eric W . Biederman" , Oleg Nesterov X-Rspamd-Queue-Id: BC95E1803F9BB X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam02 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000059, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Properly take the mmap_lock before calling into the GUP code from get_dump_page(); and play nice, allowing the GUP code to drop the mmap_lock if it has to sleep. As Linus pointed out, we don't actually need the VMA because __get_user_pages() will flush the dcache for us if necessary. Signed-off-by: Jann Horn --- mm/gup.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/mm/gup.c b/mm/gup.c index 92519e5a44b3..bd0f7311c5c6 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1552,19 +1552,23 @@ static long __get_user_pages_locked(struct mm_struct *mm, unsigned long start, * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found - * allowing a hole to be left in the corefile to save diskspace. * - * Called without mmap_lock, but after all other threads have been killed. + * Called without mmap_lock (takes and releases the mmap_lock by itself). */ #ifdef CONFIG_ELF_CORE struct page *get_dump_page(unsigned long addr) { - struct vm_area_struct *vma; + struct mm_struct *mm = current->mm; struct page *page; + int locked = 1; + int ret; - if (__get_user_pages_locked(current->mm, addr, 1, &page, &vma, NULL, - FOLL_FORCE | FOLL_DUMP | FOLL_GET) < 1) + if (mmap_read_lock_killable(mm)) return NULL; - flush_cache_page(vma, addr, page_to_pfn(page)); - return page; + ret = __get_user_pages_locked(mm, addr, 1, &page, NULL, &locked, + FOLL_FORCE | FOLL_DUMP | FOLL_GET); + if (locked) + mmap_read_unlock(mm); + return (ret == 1) ? page : NULL; } #endif /* CONFIG_ELF_CORE */