From patchwork Tue Jun 20 23:57:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Suren Baghdasaryan X-Patchwork-Id: 13286504 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F231EB64D7 for ; Tue, 20 Jun 2023 23:57:33 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E73328D0002; Tue, 20 Jun 2023 19:57:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DFBDA8D0001; Tue, 20 Jun 2023 19:57:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C9C548D0002; Tue, 20 Jun 2023 19:57:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id B4CE18D0001 for ; Tue, 20 Jun 2023 19:57:32 -0400 (EDT) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 7B3D11A0646 for ; Tue, 20 Jun 2023 23:57:32 +0000 (UTC) X-FDA: 80924790744.10.3998AF0 Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) by imf14.hostedemail.com (Postfix) with ESMTP id C4B22100003 for ; Tue, 20 Jun 2023 23:57:30 +0000 (UTC) Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=CSSYpE6o; spf=pass (imf14.hostedemail.com: domain of 36TySZAYKCNYKMJ6F38GG8D6.4GEDAFMP-EECN24C.GJ8@flex--surenb.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=36TySZAYKCNYKMJ6F38GG8D6.4GEDAFMP-EECN24C.GJ8@flex--surenb.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1687305450; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=6My5zaxRwCubM/znAlFWMrzsQs0o4/hMLfIyqDwIdCM=; b=xJM0V7l30klqqa16EN7/muq+3JMdY/geNgq7umzhYMMTC0G2Uvi+i+GoA2cO+FhCSLq9Ep 2uG652WyShgg66ZUJiVirnApzthln000/z4jTjnycbzKZg8M2TUyrO79Q08Gx3daRjsT99 DZ3D9/o4SqDYfC3vXoOKkJs/4DBTHrw= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1687305450; a=rsa-sha256; cv=none; b=unfHfWmcrh5Qzd5H9KAzptRC4Dlx+kVw4MS2UH36ikwEKV1dy7RdX8c+t8Y+O+ZVnBe59n RTIrpaXYrbQY+4KDhZ5lKy06SoDBekqHpOE+2sbw+t0FIwbYlYQodNB48m8vjILfbxiBon FET+4GOjyJ9CS+Z8qBR8hMqNkei5x/A= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=CSSYpE6o; spf=pass (imf14.hostedemail.com: domain of 36TySZAYKCNYKMJ6F38GG8D6.4GEDAFMP-EECN24C.GJ8@flex--surenb.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=36TySZAYKCNYKMJ6F38GG8D6.4GEDAFMP-EECN24C.GJ8@flex--surenb.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-ba81b37d9d2so5587934276.3 for ; Tue, 20 Jun 2023 16:57:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1687305450; x=1689897450; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=6My5zaxRwCubM/znAlFWMrzsQs0o4/hMLfIyqDwIdCM=; b=CSSYpE6o2vAYB+EczjNxHQoW9ZZEIQkPp00UpPzxbzxvXBVI4La9GGnHYy8QOAimev sfzfDqWb0009TEU/RKdrkDPXynJU93p0tuZD9SmZGHcLexKdiOKqZWJHOqcUGvtktcrY 6STtqvnsGmXhMto4nbyL6fX0OZ5Mm8HfxnS/LYv9XTquxzNy8LHbClyPaVrhoICYyZ/2 g7WkUN6m7pcrbGPcMrAUVmt45VALmV9NtE5bNAkafpbx7TM/rk6YC/Ke8TslHhaYfECz 8sS3IXfjPcEJnj01RFYOknIlwJz0+ih21+BBteNcARxJv49L9w0p5ZwII+bz34K/JCZ/ JX1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1687305450; x=1689897450; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=6My5zaxRwCubM/znAlFWMrzsQs0o4/hMLfIyqDwIdCM=; b=SCobmXJWNBF0/vF/XQesM6AgB4kp7DGg7UAB6ZiwqjXCUPS/o22QJeiDvgp6/pDsgt Be5RmTR2hw1s0v8C4tpk8GjmU9Vy9ocdYrTC1Cv6TSIs2Dg5Ky7uaSt2TE1fiFFvtP9r WrPcBCK447JMPBE+hdYF57wLTPde7NHLIrtxdoLxOgv3CJ2YhvJJMXEU0nQpyGM0myYW i/XBY5YlZfDTVtGtUA/kCdiEDR8J15ZHJB/0n7zVVZB0+4d7yXAMLRIg6ch8uCP6YdAT FHXzeQp+qr9nBzeRgtwx066Qx/iN75rF6L58XtdXkBuFqjyMi8vLEPlaVKxSry9I1Cyy OFSg== X-Gm-Message-State: AC+VfDxB85zWii0RWBbaMNneTIYpRXzusRC3PajU10EM+gTHtSKT7dK+ cLvjeuvjX6U/8xeyKaGlbj9j1kcfDGk= X-Google-Smtp-Source: ACHHUZ7lmHtfjY/K80Z1E48r7yvyTtsMdx0YbswhxFGrQ9sy28TJt2rAbO44vsYSrvgTnZ1JPXOfT1sdcAc= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3f57:9854:e19:8906]) (user=surenb job=sendgmr) by 2002:a05:6902:91:b0:ba8:6dc0:cacf with SMTP id h17-20020a056902009100b00ba86dc0cacfmr1731864ybs.12.1687305449890; Tue, 20 Jun 2023 16:57:29 -0700 (PDT) Date: Tue, 20 Jun 2023 16:57:24 -0700 Mime-Version: 1.0 X-Mailer: git-send-email 2.41.0.162.gfafddb0af9-goog Message-ID: <20230620235726.3873043-1-surenb@google.com> Subject: [PATCH 1/3] mm: change vma_start_read to fail if VMA got detached from under it From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: willy@infradead.org, torvalds@linuxfoundation.org, vegard.nossum@oracle.com, mpe@ellerman.id.au, Liam.Howlett@oracle.com, lrh2000@pku.edu.cn, mgorman@suse.de, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@android.com, surenb@google.com X-Rspamd-Queue-Id: C4B22100003 X-Rspam-User: X-Stat-Signature: b69x7ek6imy6e4zezbo16rqt165xwsgm X-Rspamd-Server: rspam03 X-HE-Tag: 1687305450-89827 X-HE-Meta: U2FsdGVkX182quzMrGta/MEPbcE3G7g6ezzt+avT4V6alW5Z6GAar9tVS4USppYK2J9V88v9E3xbek5aPFS+nEOAuCOWay4qB5C0IBprjC7Pnf9Jk0osaQdjMaz+VamIyHgaoOqTuOVUEbPWCtySBuoti3QhUPxB2b8V1MavjBgyaHETY/TSmZn1R1cMngp6Umn/WsZ26BCVHCiiHUMFuH6NNLIjPNo4g+wyHstDfWSFi8UbJN+ycfedoxWWP5ipgU6pabFIxvKrDzKNAbdZq1CrdNlw6EGYCmcYhNF7+NORyQ5bcCrF9hVZKfizzWcq4LUt4KRHYxTMPScl53fyJMc7Gkcggpa+gOPQzNrV1MAYyKFrHMlpp9uaCLocVjV8YyEn6ex8qiFVBrjOCamYFSy1XF7aJBzktNadonhDTS14iKqv2b2AXfUqkonT2ts3zd5My/EKW+XZVU6rNgq3e/cCNIjO+AlBPe3PLKDXne3nlraYMBkszIwHCu0WlnBHP6d4pghpybKO7smFJahE/2ENu4eiMULo+8lZ7cjZ4v3g+v0fTwrQPpVQkGnL9kWZSvN/UIw03QrmrXRwW7AzBIGZZxKFUk3wO9sCIahS3qmQCf8jGx3f5Nyo1eFH3XrI5mZmVyQ5lDzaBxqBBtIFPT8f/7WxxswsF0YyHNJCB17Qr0pvhcWIN5+dPi6HJj649akHCHvu63+kIgZW7opdjbd40Tmh4QMZ6nVARcHdJggiHOb7voh7helmP6Lw5s2OYN3+je7H7ZWDWPDo5vUTvfHjIoGQ2mmcFsghq3/I7Ex5qXJc6TOGdcqG/pjCXGjoJPTjOdL+wkwosoS2RZbDeJHQGurb+jCki4L0SNpBPiFXlH5Hih+W3fRdVsKBG7cDqgXnyy3ftngGQ3o+iws7rZYRgXxtuRFRUb13t0IWAt9YQFf2rav7woPlb8aUK+mftaBURN+puMxytokJFKI 7vp3Bv6e dKwlGYEJ1g2f03aLI7QPfGIEDyW66L9UKjRCD9Sge6fWhMyCw3hCbtv5Roud8OgQlvg3t4hkEKT3jDR1iOLS/EdiMWnOezsH9M7ov+r90eWUy7vjRYyCEAY1HpzIoz3IbwTWyUSqvRCqk2DkX49Il+bUQAo4ad/n3kA+6LDxUfQq2CM5VXTbmR8gALkSs8zVLSeRBJrI0t9As+kgqmD6q75RQJFPSYmJekyZbAc4GEToPHo4L26ze+ccSpxi+Qpe9O0FF9AHDMRdMB06YVMjkoUK+LWV2ycY6CSuMJEbb8QxOklL97E1UnLftULCy9sxzTvmoVsUesIpbrwTA3QMOT9ZRTpjHJ6H9Qo2ohWwoaQHC2qO1us7gC2iWjg6ayWrBgtcTo3MSFWu9iar5McxDE91iXbzTKUoG+u16IgAFbtvMFYPnIXh7Na/GEXRrhShKKxuTXGc8cWPM2TYq9btI/PyuFteddwcZ0ZntyN3NncQCrmOsgCj1yuGnZKw8C3fBOwq3LFEslXAbgAxxQQCwTAtBwwfbRawQGhNziDOKMpqYmPhmOi5GGhF7SKh3vYlcKgfWxQyZ+OIk7ecrfcBxzp8byBFd7zmDiSKx/FTlw6MCdZ5gEpC9TQhhg9uKWAbo7Og2YKhJ1G6RETQrItxaH7aT9nc6oUpPy1Y2gKENjG3GsB3UKqk1sTPCwtEmjBPE0Hd+4OQ7pzown3hdahhPEvKfkQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Current implementation of vma_start_read() checks VMA for being locked before taking vma->vm_lock and then checks that again. This mechanism fails to detect a case when the VMA gets write-locked, modified and unlocked after the first check but before the vma->vm_lock is obtained. While this is not strictly a problem (vma_start_read would not produce a false unlocked result), this allows it to successfully lock a VMA which got detached from the VMA tree while vma_start_read was locking it. New condition checks for any change in vma->vm_lock_seq after we obtain vma->vm_lock and will cause vma_start_read() to fail if the above race occurs. Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it") Suggested-by: Matthew Wilcox Signed-off-by: Suren Baghdasaryan --- include/linux/mm.h | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 27ce77080c79..8410da79c570 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -639,23 +639,24 @@ static inline void vma_numab_state_free(struct vm_area_struct *vma) {} */ static inline bool vma_start_read(struct vm_area_struct *vma) { - /* Check before locking. A race might cause false locked result. */ - if (vma->vm_lock_seq == READ_ONCE(vma->vm_mm->mm_lock_seq)) + int vm_lock_seq = READ_ONCE(vma->vm_lock_seq); + + /* + * Check if VMA is locked before taking vma->vm_lock. A race or + * mm_lock_seq overflow might cause false locked result. + */ + if (vm_lock_seq == READ_ONCE(vma->vm_mm->mm_lock_seq)) return false; if (unlikely(down_read_trylock(&vma->vm_lock->lock) == 0)) return false; - /* - * Overflow might produce false locked result. - * False unlocked result is impossible because we modify and check - * vma->vm_lock_seq under vma->vm_lock protection and mm->mm_lock_seq - * modification invalidates all existing locks. - */ - if (unlikely(vma->vm_lock_seq == READ_ONCE(vma->vm_mm->mm_lock_seq))) { + /* Fail if VMA was write-locked after we checked it earlier */ + if (unlikely(vm_lock_seq != READ_ONCE(vma->vm_lock_seq))) { up_read(&vma->vm_lock->lock); return false; } + return true; } From patchwork Tue Jun 20 23:57:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Suren Baghdasaryan X-Patchwork-Id: 13286505 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6DA43EB64DC for ; Tue, 20 Jun 2023 23:57:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D89898D0003; Tue, 20 Jun 2023 19:57:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D11618D0001; Tue, 20 Jun 2023 19:57:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B165C8D0003; Tue, 20 Jun 2023 19:57:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id A011C8D0001 for ; Tue, 20 Jun 2023 19:57:34 -0400 (EDT) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 74102C065C for ; Tue, 20 Jun 2023 23:57:34 +0000 (UTC) X-FDA: 80924790828.29.EDFC664 Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) by imf15.hostedemail.com (Postfix) with ESMTP id AD5E4A0004 for ; Tue, 20 Jun 2023 23:57:32 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=djOCkf7s; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf15.hostedemail.com: domain of 36zySZAYKCNgMOL8H5AIIAF8.6IGFCHOR-GGEP46E.ILA@flex--surenb.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=36zySZAYKCNgMOL8H5AIIAF8.6IGFCHOR-GGEP46E.ILA@flex--surenb.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1687305452; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=a/KyKqe8FdTi+g9/IKt8G5I/SC33PtSDDTh0FPFRaVQ=; b=VhttDQ7UAWVhFjBr/cGRUa9haLSqYb8FPjRWmMhvrbicks9GxQu2ZT1aTTuBzslB3tnrOn apLp2bxdDzDze+QX85GmD8aJRS9iX6gBIoRt+gyzXQkXBD8Y+7DZi/wdl2dsdo3MF7ah2u SnsUehwaojZtrRkD5p/Ot7HZtxnrh4g= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=djOCkf7s; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf15.hostedemail.com: domain of 36zySZAYKCNgMOL8H5AIIAF8.6IGFCHOR-GGEP46E.ILA@flex--surenb.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=36zySZAYKCNgMOL8H5AIIAF8.6IGFCHOR-GGEP46E.ILA@flex--surenb.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1687305452; a=rsa-sha256; cv=none; b=QrguU+hZrEnUZ8eXvEvEzP0cMuNIXpa0Cd9QVf2gvosFkqfy9/BH265bQxq0rdfprFXtOL v5RqVSqyZOLnxZ137xwRzjmKFHc8iNViYhhpybNHsLs+ypu5prqSQI8l6fGgDkSd8Ixtn8 WTjjT/3zbBg3keEyJidky/GsYMpnN/Q= Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-bc68c4e046aso5161121276.0 for ; Tue, 20 Jun 2023 16:57:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1687305452; x=1689897452; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=a/KyKqe8FdTi+g9/IKt8G5I/SC33PtSDDTh0FPFRaVQ=; b=djOCkf7sRmJEOqkBFJ1FAWr8LXWtr4BdpV1egpT43a8UfDOVBoBIuOCLxFedXjFa5b 1QOybvoapiGbw4NqKAvUWz+Fu19NBYstRwQlaC9K679sBdbRylerMVN2GPJl6f40HGRd jkUzOBouUCpguF36dwOGv4Mqx54tXxWhHGK35MaM5gY/XnL1tOp4MMdkKJjbjpszTSXG +MmeKpVWaqVgIGvTyv3WvYXc4kg3IolRfClLe0BDvx9p80AJntMQZuo8Dm0Z5JpwnDBm eulTjrH/K/rDevjtJ8yQo2HNk4iADzua7QHUx9I7o9do4iwPamwNMonQ11jiZ1XTlxGC ivrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1687305452; x=1689897452; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=a/KyKqe8FdTi+g9/IKt8G5I/SC33PtSDDTh0FPFRaVQ=; b=PgXyrCbQG9mboFc109LcbMdn/OkTJ+g/iYJuTpVThnojYg2V2KRrYlPxu3023ADLoU +cV2Ar8YJS1uCWytdjc6xvxH8wvu2jfNfMhgtSZXMGjiuu4Bux2FeOgEaJN9qXYYM7II TOgfrZAuyxfhkHn18a4IqlI+TYv1elSOpcDBVuL+jCljKzwdk+Vfx5Zbx13A0y7jPxiI 7X3hERqH14K4kE8bXklXp2cDPXha5/mk8HVqHPPlfZmVXO06hOe/B/Q3SpmgUcexCxoe 5hH1SNGdiGz/n6tkhi+iGqk3AV4EjNTQT+HYA6eot0XMcpwTtmfdro6P/e9v4QddcKsa jspA== X-Gm-Message-State: AC+VfDynZuBkm2CCCm82kd6Yl6k6WTel9QDNxNT+k+zYlVH0xG4TKn+e kWI9ah81CMBdnjyBHctkQZjnlvwdqeY= X-Google-Smtp-Source: ACHHUZ6RGKpgQ9EJdSN1FRj/ySFNHpQNXjGlsvUEbgvZMHU1XkTWuCp5dJ4lnRJ4a/8Ly/xUzjteixKvrs4= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3f57:9854:e19:8906]) (user=surenb job=sendgmr) by 2002:a25:fc28:0:b0:ba8:5bc9:80fe with SMTP id v40-20020a25fc28000000b00ba85bc980femr5330222ybd.1.1687305451896; Tue, 20 Jun 2023 16:57:31 -0700 (PDT) Date: Tue, 20 Jun 2023 16:57:25 -0700 In-Reply-To: <20230620235726.3873043-1-surenb@google.com> Mime-Version: 1.0 References: <20230620235726.3873043-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.162.gfafddb0af9-goog Message-ID: <20230620235726.3873043-2-surenb@google.com> Subject: [PATCH 2/3] mm: change vma_start_read to fail to lock a detached VMA From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: willy@infradead.org, torvalds@linuxfoundation.org, vegard.nossum@oracle.com, mpe@ellerman.id.au, Liam.Howlett@oracle.com, lrh2000@pku.edu.cn, mgorman@suse.de, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@android.com, surenb@google.com X-Rspamd-Queue-Id: AD5E4A0004 X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: bk6pmcz3wykyi85q7y6msq7u1o58xqno X-HE-Tag: 1687305452-732115 X-HE-Meta: U2FsdGVkX18B5LyXXMDtJMws3CGg69olRSByk+fq/7pPdIJLx2dBU6TwowRb2v/aicfzRt/8Qj4y+T4CRJoIw1FSgpIF+qKQO/6KmVmvJU90VJotj5uwQrS/uowgcvJ2zdGbRBhH7u0wXd7XojzjPNRnqzBy4w2A+/+MJfmYxCd0ZMLzL+Adde49mtBmSBkEwIiY3XSHOJyUseL8B3JFdgmd4loy2two3JK49g2sa1n3RKyH+B2p0ia4nS2VJ/O3vyBRLaZeGayx/XzFn/l8R1vSZDFBIPPqvvhEnyW5P6je44Sq1kp5MPaU6FUFlJY5259JwDODc89tKN79+yEW94KvcSjfiaTYyGwR1gVwsIonhs961NIkKkqAqM9aMGrETm7aWL6HiAPxRZrsSSA+Xcq3qpXwCqfDDYtB7XcbQTQJ8rQ1Lt41v+ukCigPdI9e7L0xqpAUCACm/z48iIKBd8QS5u6kM1gGc0DCJaON58QYWCrR0AY+BWqs0Kw937qt/EIXNj18hjfYB/rxKTtDMjdujeUTP6uP64kq6gRCXeYF/FF27zcjPbJayUX+xF/E/PQ0wQc8LETkDqomrbRt61kZaFW7sKThn+TcaO4YZpqVe4DtAUIs8TL0O3MNYLs2Aci0y9Pw9Z6llEAyZz1/xspVfv+ljDBA/OHCWaTu5LHhGup/yQ6FLYInFiPjBTQf0fwuOixP5VZoSraXo/qFBoboIMfRx3tVMtiMaOI7sGJbwu0qprz8XjCgytUoAqiaPW9sB39/fIAumPbtUqKGKD87eeA80A50Jql3+2I5tfUl80xDNC9uOiNVIABHANO/et8B61wi3MEu5ThSTOR9Dbi925eh7gReTmHv09raKEzQ6ny1No6hjDTaHwwAinE59lBLabiQhbXZK1N8FLuZ/mG6wl0oUy6Ign2rSDvXM2bv1Cdp28QLdC0MgPUAp20esEAYKWV4zFSpIRigcd3 jnxS05sm lLPhSrU0AnLcZmPA+2ddqlWMftiIm8oUJJ+IRAENbAiCaPiYQeD9mPwaXjl/y3v5hFfS2xq0pXj76+uX46cQlvceg+2+PjDVnDczT118Djg7xPU9QgPB35cM1Naheqc2xr3MzUV0vbqb3sPglmTKWTBTSNvFBxVtsv9QV0MmM8nT8TALyw8JHzHLukFg7Qd9+dLwueMdyLtF8QSFF3AYsLJdOEWNykWvODcrNKONdLaelTwOnYyGKfMF2+wJp1SkIPYeniXfyCX5CiZV0n9xxVJntFEZsuTBEDzvYjwkLVl/rK+9qotbR65doxJXZvKxb/XBjtbGrh2Okatow0shmn5nrvdf3JdCiOW8Vz017hr3tZLbiIsQAtQdEFaU3g7xkF+lmZiPNgTuZAUsV0/bKsg9tNEfDGzNTpObjF1w4elHnMRdS6pQs0NPVw0/atr5X6E/01xO1A8NWFl43F94fNdvtvTeZIJnNx1i11ZMC0CevsZinuicMXPN6SCBDm6FjCcaj/eLRk98R9J/z75rS6xUqHZqCtKk8AlCN99otRwmfNV/yQWl8RFMyXpBVmtCtqGNY9p+BnGfVZM0/39jmkMxSjSphhJP18za+fdEBh2g1yjTMm7jqrNqF9SlSTmbzl+bZDWTRmWldYYMaKz7IsqkcGVh/v1IsdiCaO9O3KqEUM5JJG7bcA12qWUE7yjnCWrIcVDUxAtRANaajDx9fZgg+QQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: vma_start_read can successfully lock a detached VMA relying on its caller to check for vma->detached. Change vma_start_read to include that check and fail if the VMA got detached. Suggested-by: Linus Torvalds Signed-off-by: Suren Baghdasaryan --- include/linux/mm.h | 4 ++-- include/linux/vm_event_item.h | 1 - mm/memory.c | 10 +--------- mm/vmstat.c | 1 - 4 files changed, 3 insertions(+), 13 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 8410da79c570..74e3033c9fc2 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -651,8 +651,8 @@ static inline bool vma_start_read(struct vm_area_struct *vma) if (unlikely(down_read_trylock(&vma->vm_lock->lock) == 0)) return false; - /* Fail if VMA was write-locked after we checked it earlier */ - if (unlikely(vm_lock_seq != READ_ONCE(vma->vm_lock_seq))) { + /* Fail if VMA is detached or was write-locked after we checked it earlier */ + if (unlikely(vma->detached || vm_lock_seq != READ_ONCE(vma->vm_lock_seq))) { up_read(&vma->vm_lock->lock); return false; } diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h index 8abfa1240040..e741098954ff 100644 --- a/include/linux/vm_event_item.h +++ b/include/linux/vm_event_item.h @@ -154,7 +154,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, VMA_LOCK_SUCCESS, VMA_LOCK_ABORT, VMA_LOCK_RETRY, - VMA_LOCK_MISS, #endif NR_VM_EVENT_ITEMS }; diff --git a/mm/memory.c b/mm/memory.c index f69fbc251198..bd666fa20748 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5275,7 +5275,7 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm, struct vm_area_struct *vma; rcu_read_lock(); -retry: + vma = mas_walk(&mas); if (!vma) goto inval; @@ -5306,14 +5306,6 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm, goto inval; } - /* Check if the VMA got isolated after we found it */ - if (vma->detached) { - vma_end_read(vma); - count_vm_vma_lock_event(VMA_LOCK_MISS); - /* The area was replaced with another one */ - goto retry; - } - rcu_read_unlock(); return vma; inval: diff --git a/mm/vmstat.c b/mm/vmstat.c index c28046371b45..5d6acdb1b611 100644 --- a/mm/vmstat.c +++ b/mm/vmstat.c @@ -1403,7 +1403,6 @@ const char * const vmstat_text[] = { "vma_lock_success", "vma_lock_abort", "vma_lock_retry", - "vma_lock_miss", #endif #endif /* CONFIG_VM_EVENT_COUNTERS || CONFIG_MEMCG */ }; From patchwork Tue Jun 20 23:57:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Suren Baghdasaryan X-Patchwork-Id: 13286506 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DED14EB64D7 for ; Tue, 20 Jun 2023 23:57:37 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 54B718D0005; Tue, 20 Jun 2023 19:57:37 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4AD578D0001; Tue, 20 Jun 2023 19:57:37 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2FFEB8D0005; Tue, 20 Jun 2023 19:57:37 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 1B8898D0001 for ; Tue, 20 Jun 2023 19:57:37 -0400 (EDT) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id E0EA6A062A for ; Tue, 20 Jun 2023 23:57:36 +0000 (UTC) X-FDA: 80924790912.07.B776BC7 Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) by imf18.hostedemail.com (Postfix) with ESMTP id 2F0691C0013 for ; Tue, 20 Jun 2023 23:57:34 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=P9ZGKNT+; spf=pass (imf18.hostedemail.com: domain of 37jySZAYKCNsPROBK8DLLDIB.9LJIFKRU-JJHS79H.LOD@flex--surenb.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=37jySZAYKCNsPROBK8DLLDIB.9LJIFKRU-JJHS79H.LOD@flex--surenb.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1687305455; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=BGbrY/f1fvBNW9z8go6Nnz06u29111qaAGQndqYmZbI=; b=4f5SmV8wtY+g4vXqtjwG1j4pujeRN5TeNAoQbRk9spvfQOwcIlsdgDR6S0qCCdQ7JE3djk jImb040DXL38amKwLfWSiJvQPu2rQcUSzSfurmlwJf+5TDa67avfAYVC0Wf6EdCRsUjXcy MPhB7R6lkW7aeT0KwmEOmlrbUz19U9U= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1687305455; a=rsa-sha256; cv=none; b=6OBiSjKBvB4DkCYF50bHE0ePNT6LaY2w76D+swJ7MpbOyHt4iNelEe4E9gBGtAbl8UirVc KiiGQzqs5muNGuZ+g6Vp+v6xgxkHAp2vdzJoBNiXN4VXvafTpFCQznVIitV88Ieca6IQJL w7Ao+JzhL+ffmNYWFxmKoZE5QQigj1A= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=P9ZGKNT+; spf=pass (imf18.hostedemail.com: domain of 37jySZAYKCNsPROBK8DLLDIB.9LJIFKRU-JJHS79H.LOD@flex--surenb.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=37jySZAYKCNsPROBK8DLLDIB.9LJIFKRU-JJHS79H.LOD@flex--surenb.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-bb2a7308f21so6657159276.2 for ; Tue, 20 Jun 2023 16:57:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1687305454; x=1689897454; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=BGbrY/f1fvBNW9z8go6Nnz06u29111qaAGQndqYmZbI=; b=P9ZGKNT+TEzfnNjgXfWsFMxrjrmo19InxA9Ltzw94eBOzcf0DrJjIadY39g5B1ARES UM8Tb66YAZoM1qvWyjNLmdfb7GBwdGln7qA5RgXbZWXGaZHvI0XHaH/HBL1QpJNOQgUm 6OloW5Gfvh2xzMIEA3ALlJsZDF0ta5gG6htWRcVitzaGC/HTclOzVZESltb69EPM+Vbp ulOrRqMr+3gQkWyLLTEaVyZRb1j645qYTNnqpW50MZl/4SibKrzjz7laJRB/LZnjYsyE XMOaY7sjsOrxZl8Y6VKGCVQZWc8BmHDWraN0TJszAdVqPx1QEoL6EPZTqJhDF1Ftewq7 eOYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1687305454; x=1689897454; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=BGbrY/f1fvBNW9z8go6Nnz06u29111qaAGQndqYmZbI=; b=Pkc3UUHTVbziwgCCRbTNdrBDIhN4G3g4NZlNGgbiuD6PuB1veFndy/1QYhEe8DHarU +Nwa/Xf47/FDtVA2COq6wvErEmiBWFevbqecCRFw7sLEBkS0Frzw91oo1bibpJfS6jl3 PQ7+R5QQk9kpAmW565FiU4B5rRQLWlzwWurriA+ffheew1MHyLh/g7Kv0wEpNWk1Ik8j kYHJeg7+z1sQa8hcnCGgZpdCKpkfCgHghIqN4YRQH7wDvWsZ/ImUTMUm8c29XpMvVUzn rcu4QmWq46mJFE5vcg02FbJSH3TFZiXOhYU6A26oAbkBV8f8p0pSGweN6MGX1hOz1k3P EeOA== X-Gm-Message-State: AC+VfDxHynlOnydr6UnKOUulbKWJ/H8dcqPfJgcE/xiq2m+5DNThx9d/ sKOW7Op+2TSXDLV4+gFTclv/qpKDvck= X-Google-Smtp-Source: ACHHUZ6kw7oTpcpzUTFKAorHv5DtOn6LBqwlXR1p5RtO+KTrOjHZ+LXWbslSzGMAafSpF8zUkeChCRjPRTw= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:201:3f57:9854:e19:8906]) (user=surenb job=sendgmr) by 2002:a5b:bc9:0:b0:bad:41b:f343 with SMTP id c9-20020a5b0bc9000000b00bad041bf343mr5127082ybr.1.1687305454340; Tue, 20 Jun 2023 16:57:34 -0700 (PDT) Date: Tue, 20 Jun 2023 16:57:26 -0700 In-Reply-To: <20230620235726.3873043-1-surenb@google.com> Mime-Version: 1.0 References: <20230620235726.3873043-1-surenb@google.com> X-Mailer: git-send-email 2.41.0.162.gfafddb0af9-goog Message-ID: <20230620235726.3873043-3-surenb@google.com> Subject: [PATCH 3/3] mm: check for VMA being detached before destroying it From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: willy@infradead.org, torvalds@linuxfoundation.org, vegard.nossum@oracle.com, mpe@ellerman.id.au, Liam.Howlett@oracle.com, lrh2000@pku.edu.cn, mgorman@suse.de, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@android.com, surenb@google.com X-Stat-Signature: fe8uwfxxhtxosmuqarzp73hinwgp8sio X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 2F0691C0013 X-Rspam-User: X-HE-Tag: 1687305454-215222 X-HE-Meta: U2FsdGVkX1+2p0cHr9fXox52BXOWW8F3CGT5WEiBpKEUrh1xuhGNZnYACnkHjoJbw2ozsT7pV7AqT/t3CS0CnIr3fcKq2asr2ReueTfj2yg3xKNay2HGuKSYgaWtnjOQlM4JLbldiHccF7ZSLbOy7/j5Z7WrFYfxLiIoKFxx54kGY2KGGsHKmatSHUPOXuxZQ5iHjvke1yMVBtPpnumnKXM+eLNJwl10bl0TfmPEXDSj7fhcjAfVy+9rXEv00b95sPs3IiOiLgCwfpgw9sEJ0k9bqUd0L79Jtp4BHpna483zlF5+U3E8pk2e/2rx+8Wr3Ykc28j2xkK7/OzVlrMFRfbY47minMhtsYMSIvotVRZ8zeLScThhovVo9qUWcegUvpSJoimpyv9KPs+EtAyos1SaHzG2iZjkpUOzrRk1sSqxL8AbIJ/+u0FdToO0Atx14cR5DolyKjmVYms8M7K2XSqexckhC0yJXOn+upGdU/KhTdm8L7T3W0lZkaE0KqiEY5RraFkMHSB1hR4Xp0kh2962wVPbdA0yObT9Jk17l21vKJnD1Hvs7d2d9gmKNQUBF66SELnSzKzZZPpwuynMV27ujKEW/n0jyP7GvP7CjpseGjYf7UXixOhJ6m+B6WoWUFoswyMjtmOZI9K/A/ktkSTb2MQiQ6OfTIOslNfKUblaSy+DEZcsPyqGmngq0aXyce8yHK17dfafacCNUd9tE8XZ5F//14H3Lr/YMhwLd/vXuczLdne3WGMuj1OL+CLMjwuqHpdJCHqSq5UelWJvuawr862WkITe012IvoRtloQRrK7BnpNny1xnfD5Q0i3lOZ5FIyBMsSNuIIUQM6w4BHFp94QCwNM0nuHP7SA4vmZziZK8FGAHebeeczYrhd1hWrdOZvQHt1fhgfg6jcuVoyS5RBqBOjr4V+/BPPaiYUSGoumZFzUUvWxqqNctlGzI5ppTTs8OawTm0N2l/lK Iu81U9GS DJE1pSoctQVYcrjJ8exgSbadWEBflrembD+ghOLF5IYHRX9qzoH9lTJPYKUAow1utGqtlyvmlLJk/ydBb6+RUSY5Jh17I40XNa7NoM2b8AbfXxyJ6p9KKcb9W7cCBsZpzL6RMeQn0wCjFAavgZQ8a21XaxrpK1tb9cNINFo4ji/mjqIHpwc5DmZ7yFa3vFRlNgVdfrdOYDkPO+pNEK5o0N/F5MU9uRTapI3Qby6zdHsNo2yPe8OfGdL1wFC9lHOoGANowDR1bZ/BIlOOia96DMt8eQB6snTxyvMaDvhKAKzh5j+OncymVEmPbeKvFpNItoeL6mQGlCZMnNouMupg3RDEb+7er9u+bbVR6QxDYljLTAqfSpfcSvpgY6bTX5WgQphmLZtTaMfTHhp89qmNFMKOkREJ5E1bqVNX33CSlYX0pJ/QJ3FfXXcd//023tY0Dj/UOrx8Ju4Lvf19gqbNtD/HK+9/1J7cUy4JMe8q8XMqvm7sq4TGcmwt2Ma/MYmbQnEFE3mxq43xUh/M+XUiGZduwpXEqa5B8yyxFlFoGNyrtwp3MKvoM5TpCiqEVuBoN6tRTaYKtCbrkaE9/ZBJYqqanXtHWINkPk3Ak+18xmuPlKSYrjhyPcc1NYknHOzHQ/MnKYseUOsEcnnbnMA63q4Hi8O+wWIhe+R5t X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: By the time VMA is freed it has to be detached with the exception of exit_mmap which is destroying the whole VMA tree. Enforce this requirement before freeing the VMA. exit_mmap in the only user calling __vm_area_free directly, therefore it won't trigger the new check. Change VMA initialization to mark new VMAs as detached and change that flag once the VMA is added into a tree. Suggested-by: Linus Torvalds Signed-off-by: Suren Baghdasaryan --- include/linux/mm.h | 4 ++-- kernel/fork.c | 2 ++ mm/internal.h | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 74e3033c9fc2..9a10fcdb134e 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -247,7 +247,7 @@ void setup_initial_init_mm(void *start_code, void *end_code, struct vm_area_struct *vm_area_alloc(struct mm_struct *); struct vm_area_struct *vm_area_dup(struct vm_area_struct *); void vm_area_free(struct vm_area_struct *); -/* Use only if VMA has no other users */ +/* Use only if VMA has no other users and might still be attached to a tree */ void __vm_area_free(struct vm_area_struct *vma); #ifndef CONFIG_MMU @@ -751,7 +751,7 @@ static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm) vma->vm_mm = mm; vma->vm_ops = &dummy_vm_ops; INIT_LIST_HEAD(&vma->anon_vma_chain); - vma_mark_detached(vma, false); + vma->detached = true; vma_numab_state_init(vma); } diff --git a/kernel/fork.c b/kernel/fork.c index 41c964104b58..000fc429345c 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -540,6 +540,7 @@ static void vm_area_free_rcu_cb(struct rcu_head *head) /* The vma should not be locked while being destroyed. */ VM_BUG_ON_VMA(rwsem_is_locked(&vma->vm_lock->lock), vma); + WARN_ON_ONCE(!vma->detached); __vm_area_free(vma); } #endif @@ -549,6 +550,7 @@ void vm_area_free(struct vm_area_struct *vma) #ifdef CONFIG_PER_VMA_LOCK call_rcu(&vma->vm_rcu, vm_area_free_rcu_cb); #else + WARN_ON_ONCE(!vma->detached); __vm_area_free(vma); #endif } diff --git a/mm/internal.h b/mm/internal.h index 68410c6d97ac..728189e6c703 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -1068,6 +1068,7 @@ static inline void vma_iter_store(struct vma_iterator *vmi, vmi->mas.index = vma->vm_start; vmi->mas.last = vma->vm_end - 1; mas_store_prealloc(&vmi->mas, vma); + vma_mark_detached(vma, false); } static inline int vma_iter_store_gfp(struct vma_iterator *vmi,