From patchwork Wed Feb 23 15:59:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Wilcox X-Patchwork-Id: 12757149 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2380EC433F5 for ; Wed, 23 Feb 2022 15:59:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 943498D0021; Wed, 23 Feb 2022 10:59:43 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8F3F48D0011; Wed, 23 Feb 2022 10:59:43 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7E2B68D0021; Wed, 23 Feb 2022 10:59:43 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0045.hostedemail.com [216.40.44.45]) by kanga.kvack.org (Postfix) with ESMTP id 5893E8D0011 for ; Wed, 23 Feb 2022 10:59:43 -0500 (EST) Received: from smtpin30.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id E4FAE8249980 for ; Wed, 23 Feb 2022 15:59:42 +0000 (UTC) X-FDA: 79174505004.30.7D5E7A4 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf28.hostedemail.com (Postfix) with ESMTP id 4A1DFC000F for ; Wed, 23 Feb 2022 15:59:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Content-Transfer-Encoding:MIME-Version: Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:In-Reply-To:References; bh=U1NJLx2hNGzn0cF6hu7XUgutHeB7KzSAS3+ZL8eXD0c=; b=sI/6jm4ANMJu2XxEFZa6wo+hHy TuR5xBR9lM5xrobaeW8u9ebzG577X2PORDlb5LJkqggX8lWqoBhEgF0o39ZZMq3znekbvNdLJYxdF aLDJ0lR5Q+qaq3N29TO+vZvDmZ8Qb0Uv8aW65L5cHjNCiYxbcKgnlr3I36994zBhTe3DdUOTwAwVl 7oiGWpcAkw1Az8BiFa5vCHVpuMAsBmoV82WmFaCmcgB0EIszgU6y/PBIqC1A0ylGXnsSQDcd3lnAf u090fogA7nsPBAqX6xPvctNvg60gd0j1vy0AA9lxezzKMzHhwAiTd6WeDSxNEgi8KiK3dqPzl0gk0 L2LAg8Yg==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1nMu3D-003tMu-EB; Wed, 23 Feb 2022 15:59:35 +0000 From: "Matthew Wilcox (Oracle)" To: stable@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kirill.shutemov@linux.intel.com, Song Liu Cc: "Matthew Wilcox (Oracle)" , Adam Majer , Dirk Mueller , Takashi Iwai , Vlastimil Babka Subject: [PATCH] mm/filemap: Fix handling of THPs in generic_file_buffered_read() Date: Wed, 23 Feb 2022 15:59:18 +0000 Message-Id: <20220223155918.927140-1-willy@infradead.org> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 4A1DFC000F X-Stat-Signature: 3ypwcrojxyr5ar7qiycphnc6hxg4wie8 Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b="sI/6jm4A"; spf=none (imf28.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none X-Rspam-User: X-HE-Tag: 1645631981-866220 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When a THP is present in the page cache, we can return it several times, leading to userspace seeing the same data repeatedly if doing a read() that crosses a 64-page boundary. This is probably not a security issue (since the data all comes from the same file), but it can be interpreted as a transient data corruption issue. Fortunately, it is very rare as it can only occur when CONFIG_READ_ONLY_THP_FOR_FS is enabled, and it can only happen to executables. We don't often call read() on executables. This bug is fixed differently in v5.17 by commit 6b24ca4a1a8d ("mm: Use multi-index entries in the page cache"). That commit is unsuitable for backporting, so fix this in the clearest way. It sacrifices a little performance for clarity, but this should never be a performance path in these kernel versions. Fixes: cbd59c48ae2b ("mm/filemap: use head pages in generic_file_buffered_read") Cc: stable@vger.kernel.org # v5.15, v5.16 Link: https://lore.kernel.org/r/df3b5d1c-a36b-2c73-3e27-99e74983de3a@suse.cz/ Analyzed-by: Adam Majer Analyzed-by: Dirk Mueller Bisected-by: Takashi Iwai Reported-by: Vlastimil Babka Signed-off-by: Matthew Wilcox (Oracle) --- mm/filemap.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index 82a17c35eb96..1293c3409e42 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2354,8 +2354,12 @@ static void filemap_get_read_batch(struct address_space *mapping, break; if (PageReadahead(head)) break; - xas.xa_index = head->index + thp_nr_pages(head) - 1; - xas.xa_offset = (xas.xa_index >> xas.xa_shift) & XA_CHUNK_MASK; + if (PageHead(head)) { + xas_set(&xas, head->index + thp_nr_pages(head)); + /* Handle wrap correctly */ + if (xas.xa_index - 1 >= max) + break; + } continue; put_page: put_page(head);