From patchwork Fri Jan 28 06:19:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Xu X-Patchwork-Id: 12727974 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED9C7C433F5 for ; Fri, 28 Jan 2022 06:19:32 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 74AF96B0074; Fri, 28 Jan 2022 01:19:32 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 706806B007D; Fri, 28 Jan 2022 01:19:32 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5C1C66B007E; Fri, 28 Jan 2022 01:19:32 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0123.hostedemail.com [216.40.44.123]) by kanga.kvack.org (Postfix) with ESMTP id 4F4766B0074 for ; Fri, 28 Jan 2022 01:19:32 -0500 (EST) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 0D1B295268 for ; Fri, 28 Jan 2022 06:19:32 +0000 (UTC) X-FDA: 79078694184.28.BF0DDDA Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf12.hostedemail.com (Postfix) with ESMTP id AD68940007 for ; Fri, 28 Jan 2022 06:19:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1643350771; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RToFXIUfsXCiLH3IYE93p3Ce7kkEvmZK7yXFyS7R3rs=; b=S28nupFpkju9ohkg76VYTwF/NK9U3niH+ebuVVqm8+HRdX0v3Tg3h9U6d4p/hwLvAozgik QhQ1HULjP8n3Xet5W1dNCOykbU+Cv4WwJunvYsePwww9g0AU22ctwa8MYTgvoOKW08Bio3 3L4rlDLhRDgTQn/CClr00cMox7mj2fY= Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-426-4EFLg4jwPse2vjm0e3xD3g-1; Fri, 28 Jan 2022 01:19:28 -0500 X-MC-Unique: 4EFLg4jwPse2vjm0e3xD3g-1 Received: by mail-pf1-f199.google.com with SMTP id a12-20020a056a001d0c00b004cc283b2e30so2896668pfx.2 for ; Thu, 27 Jan 2022 22:19:28 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=RToFXIUfsXCiLH3IYE93p3Ce7kkEvmZK7yXFyS7R3rs=; b=xMdyj64LSCU1dO/pgJDI5fyqxpqpK/Yx6hLYdxXbcH0OnpMr+pmejiAqVRS+rolDKQ EoCRnvLeCd4QgNGpPArET9qXExvjNhrRSDO2hOis16KvcbtEJCNJ6u82vxXmjjJ65aX7 Vj3QZfWgGWoWRBQBS7KroZRV9xO3mOfzHGeNcir9K6E5woiMKfkufybdRbp/l8q9wYm+ 87oZ5gq57E5oUSQJ44vfZ+Zv4Q95ov2J/7GAlQUhzeAFPCEjEn2EUG3RnIWs7E3pQ56M f4NOCL+ippfqWdyVmq5Nf422TzBkJ7vU1FIPByDtOXgD0iYeUcHIw7aNXWtC7dDpvOST DzRA== X-Gm-Message-State: AOAM533qwkih5dgKdyOCJXZ+PUd0hLUi7Q0+LKowHBYQGmsei8CR/kJS dTqtHDOlsHRO7Bg5X21R3pALQFHANzIHvOhg730H/XqF5fJwqJLSsaVfGylcfMHqi4aTBEIwxFm 73tuh2ilYyGphuhZc46g9+gVvfD7HU25ds5gZgJSfKFpzBBG5Eq+xX/x7mOlj X-Received: by 2002:a17:902:ce8d:: with SMTP id f13mr6747645plg.142.1643350767586; Thu, 27 Jan 2022 22:19:27 -0800 (PST) X-Google-Smtp-Source: ABdhPJwRaHK4URjqYNa73vAYGcVE+xtCjMwOyQ/++59IxtYTc4ppN/5o14unYbibM6qPH8lw/S7jkg== X-Received: by 2002:a17:902:ce8d:: with SMTP id f13mr6747619plg.142.1643350767226; Thu, 27 Jan 2022 22:19:27 -0800 (PST) Received: from localhost.localdomain ([94.177.118.75]) by smtp.gmail.com with ESMTPSA id p17sm3241049pfo.11.2022.01.27.22.19.22 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 27 Jan 2022 22:19:26 -0800 (PST) From: Peter Xu To: linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Jason Gunthorpe , Andrew Morton , peterx@redhat.com, Andrea Arcangeli , Jan Kara , =?utf-8?b?SsOpcsO0bWUgR2xpc3Nl?= , John Hubbard , "Kirill A . Shutemov" , Alex Williamson Subject: [PATCH v2] mm: Fix invalid page pointer returned with FOLL_PIN gups Date: Fri, 28 Jan 2022 14:19:18 +0800 Message-Id: <20220128061918.20121-1-peterx@redhat.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: AD68940007 X-Stat-Signature: w4g85eqwhmetje8ch7ycar7uocm9b9ar X-Rspam-User: nil Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=S28nupFp; spf=none (imf12.hostedemail.com: domain of peterx@redhat.com has no SPF policy when checking 170.10.133.124) smtp.mailfrom=peterx@redhat.com; dmarc=pass (policy=none) header.from=redhat.com X-HE-Tag: 1643350771-859468 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Alex reported invalid page pointer returned with pin_user_pages_remote() from vfio after upstream commit 4b6c33b32296 ("vfio/type1: Prepare for batched pinning with struct vfio_batch"). This problem breaks NVIDIA vfio mdev. It turns out that it's not the fault of the vfio commit; however after vfio switches to a full page buffer to store the page pointers it starts to expose the problem easier. The problem is for VM_PFNMAP vmas we should normally fail with an -EFAULT then vfio will carry on to handle the MMIO regions. However when the bug triggered, follow_page_mask() returned -EEXIST for such a page, which will jump over the current page, leaving that entry in **pages untouched. However the caller is not aware of it, hence the caller will reference the page as usual even if the pointer data can be anything. We had that -EEXIST logic since commit 1027e4436b6a ("mm: make GUP handle pfn mapping unless FOLL_GET is requested") which seems very reasonable. It could be that when we reworked GUP with FOLL_PIN we could have overlooked that special path in commit 3faa52c03f44 ("mm/gup: track FOLL_PIN pages"), even if that commit rightfully touched up follow_devmap_pud() on checking FOLL_PIN when it needs to return an -EEXIST. Attaching the Fixes to the FOLL_PIN rework commit, as it happened later than 1027e4436b6a. Cc: Andrea Arcangeli Cc: Andrew Morton Cc: Jan Kara Cc: Jérôme Glisse Cc: John Hubbard Cc: Kirill A. Shutemov Fixes: 3faa52c03f44 ("mm/gup: track FOLL_PIN pages") Reported-by: Alex Williamson Debugged-by: Alex Williamson Tested-by: Alex Williamson Signed-off-by: Peter Xu Reviewed-by: John Hubbard --- v2: - Drop the WARN_ON_ONCE() [Jason, John] - Add Alex's Tested-by too, as after dropping the WARN_ON_ONCE() then the patch is exactly the one that Alex helped on bug verification, hence very safe to grant the credit alongside. --- mm/gup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/gup.c b/mm/gup.c index f0af462ac1e2..65575ae3602f 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -440,7 +440,7 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, unsigned int flags) { /* No page to get reference */ - if (flags & FOLL_GET) + if (flags & (FOLL_GET | FOLL_PIN)) return -EFAULT; if (flags & FOLL_TOUCH) {