From patchwork Fri Jan 31 14:37:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Ricardo_Ca=C3=B1uelo_Navarro?= X-Patchwork-Id: 13955440 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1DA7C0218F for ; Fri, 31 Jan 2025 14:38:14 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 59F4C280002; Fri, 31 Jan 2025 09:38:14 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 54F70280001; Fri, 31 Jan 2025 09:38:14 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4171E280002; Fri, 31 Jan 2025 09:38:14 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 23E50280001 for ; Fri, 31 Jan 2025 09:38:14 -0500 (EST) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id BE34B1A0E22 for ; Fri, 31 Jan 2025 14:38:13 +0000 (UTC) X-FDA: 83068002066.24.0C6E67B Received: from fanzine2.igalia.com (fanzine.igalia.com [178.60.130.6]) by imf23.hostedemail.com (Postfix) with ESMTP id CCFC9140015 for ; Fri, 31 Jan 2025 14:38:11 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=igalia.com header.s=20170329 header.b=JEo5BeXZ; spf=pass (imf23.hostedemail.com: domain of rcn@igalia.com designates 178.60.130.6 as permitted sender) smtp.mailfrom=rcn@igalia.com; dmarc=pass (policy=none) header.from=igalia.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1738334292; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=z44wbJoCgpaFpfxyIjE4KNNRI0pn+AfD1gje/+p6F2o=; b=lxQuG1REK6kLtlNjKbYJLZ72lmpZza1cfETT5FurofTZurV1DYoVWU5UkdBAgrrceiEucO MdGVD6ebh7gyqBfdG/aIfwGtLNXsOdupqYdFvCUI+MjBK227gDXJl2VSK/yMC5GW94jqnt a/HZonM1UMQpA0B9R4paAOaIeHAMpE4= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1738334292; a=rsa-sha256; cv=none; b=1u3Umhxx8sIBC4s9WdS+0buxccs4GG8SUv9cWLa08PnMeqTTAi0phC9fwZDgjKDDnT5pY7 lBPKpMCsZLTD+zdL0OpkI6knfJ3qA4nJZV5ERcP7MkzsnXZJjy7wPQH3xy5fzGvKj+quZk OEknyDGnB1XMcXfKfGupwtAG6IXHglw= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=igalia.com header.s=20170329 header.b=JEo5BeXZ; spf=pass (imf23.hostedemail.com: domain of rcn@igalia.com designates 178.60.130.6 as permitted sender) smtp.mailfrom=rcn@igalia.com; dmarc=pass (policy=none) header.from=igalia.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=z44wbJoCgpaFpfxyIjE4KNNRI0pn+AfD1gje/+p6F2o=; b=JEo5BeXZqpdQGxy9hwQkAuE9f/ yTThSUqea1g5hM03dajYu3wWCDdRYmePf53OFxSdBX8o3cZYy0o6WpjtM1zo0SL51ZBSGJaW288lL YcXE9XG/Y3XhgwObsq5bKGmXNAz58wymRFUYCqfCw0tGSiUMMplf6axjc20euEUs1pLoocFen39PS fO3aLnb2MrY3wMB189IC7vJ1QpskXfmUJS4hwjOToJN7obZadVHwK4xyny2YnPVmaTq44itfLXM+q y7HuOtiZsCqmAmdn7kBmxmrmuOosWhWmqHHVJ1A7qkWZ35ih66WhJxeZuVKMjlxS8S8lscBChTE+P KEDeLqyw==; Received: from 253.red-79-144-234.dynamicip.rima-tde.net ([79.144.234.253] helo=localhost.localdomain) by fanzine2.igalia.com with esmtpsa (Cipher TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim) id 1tds9f-001W0H-9s; Fri, 31 Jan 2025 15:38:05 +0100 From: =?utf-8?q?Ricardo_Ca=C3=B1uelo_Navarro?= To: akpm@linux-foundation.org, riel@surriel.com Cc: linux-mm@kvack.org, stable@vger.kernel.org, kernel-dev@igalia.com, revest@google.com Subject: [PATCH] mm,madvise,hugetlb: check for 0-length range after end address adjustment Date: Fri, 31 Jan 2025 15:37:49 +0100 Message-ID: <20250131143749.1435006-1-rcn@igalia.com> X-Mailer: git-send-email 2.48.1 MIME-Version: 1.0 X-Stat-Signature: xp3j73qh37f5a6j1a6d4oj4eeb4u5on6 X-Rspamd-Queue-Id: CCFC9140015 X-Rspam-User: X-Rspamd-Server: rspam06 X-HE-Tag: 1738334291-99727 X-HE-Meta: U2FsdGVkX1+GDOyoUzNM84oQJsFp+Njaf14g7icB1EX+dWkXvVDftg/97LTSHJKNEmGmJ49e0gMkEHZKd/hi+CIvW1KFL5kJRHaDz/7fALP4Ve/xv4uAX6bokl+uTAnQyBx0bnrhPs3BV9bq5hxqqrWiE9mcMTFbGmrsSTuyxq9VM4gc4D3tzI59AUDoNJcGzuwvGtbO167Pjp2aqK8mTioeByZsVkU8RkKYZNk8PgKvhIaC281QN2YnLQ3TtLQQJLJNgiVA8ZiDhsNwqGUf+fve5pVwIYp3zvMdZiXyt9tVMNmnpox3JbMX9GR4jamX8NpZ6n0LuHz/EC5AbB8GjA6Gbf2WhO9XY30Z7QutwItaETtanqlxIxYb3FSoyPuv+ag4X0DZ3BUSPIcaiOdAb7BSnIL+rJLP8yFaAC8ggaIJkUYRV15BV+pyZKbh+IHfvgOwH7ZqOVqVcyA80gKp1Hr5OyEnI5XyOurpK4LCmlS6/DmmliNjtTsvTU4urn3VDZx2dOKiykQiS2R70MRq4v7erZZbmkI2VODlJUx+UxLJ6D49hDBiUgnZcOeJ0DBzEAMPZrHcxEgbRT1jaFxwLGv0V0BTwSBfSpaQU7RrTwq8Hb/H/KhlFnesDEzmy5nUNnBaZ7YFS44u8FO8IU1t6MTI4ECVZJAmJ7Hh4XFnK8W1t7hVf5Pysh6LbdOUSj4doy7hJrdaJ2s/jKX3GFtZ7aIlM/g6dkl8rzwQP32eMFeX7b8WYUxg15dW8TsBVGq2wW1unOl/DfKUKSTdjddT4a8VestBl47miETI6sEYCyAIHgz0l+uvo6eOTqF5ll249sgkZsw0X47OLLytIGw2xlx87vCHMWczNYA7nHR7ocLmxrGpeQFM9Sqe4+/tSfgtXQrM8ganRkDPIK3PfU11AedZcJvp6Pu94uRBD0O6n/kIUb4lEZPocJjJgc3/2b6LWFTu91NHa6Kgl1AqteS dLYF045F 2wjKnxL8JvGic5GuFa6OlfMo6aDi8KYf1yFeABNmiEsWbUekksziRIC0ltgAJByzwerbBMr7TkAYxDahoIfL4I7pxJUxZLablb4HiziMSP217Q9aByXQyX2ttoYG6csLhk5kYmsPyWTXOikr+t4yxOT+IXBZ9ByNtjPptIm4bBStkbwl7o3amG55+7T7elgmiOSuMGNAE4/wG/QHjnURyn1sZTYjHNSbWKXTrUCyqSmJh4hvf5+AKMd28fOXX32vW5zCkZnvrvGEZkYUPRjH9WWkMeUmt1oDMruUiW9G4kyIydBng3FHyctQEqsQu12LcBUdbvHHYZn/wa29JhC7NPU+aX45KFazeqIc2 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000008, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Add a sanity check to madvise_dontneed_free() to address a corner case in madvise where a race condition causes the current vma being processed to be backed by a different page size. During a madvise(MADV_DONTNEED) call on a memory region registered with a userfaultfd, there's a period of time where the process mm lock is temporarily released in order to send a UFFD_EVENT_REMOVE and let userspace handle the event. During this time, the vma covering the current address range may change due to an explicit mmap done concurrently by another thread. If, after that change, the memory region, which was originally backed by 4KB pages, is now backed by hugepages, the end address is rounded down to a hugepage boundary to avoid data loss (see "Fixes" below). This rounding may cause the end address to be truncated to the same address as the start. Make this corner case follow the same semantics as in other similar cases where the requested region has zero length (ie. return 0). This will make madvise_walk_vmas() continue to the next vma in the range (this time holding the process mm lock) which, due to the prev pointer becoming stale because of the vma change, will be the same hugepage-backed vma that was just checked before. The next time madvise_dontneed_free() runs for this vma, if the start address isn't aligned to a hugepage boundary, it'll return -EINVAL, which is also in line with the madvise api. From userspace perspective, madvise() will return EINVAL because the start address isn't aligned according to the new vma alignment requirements (hugepage), even though it was correctly page-aligned when the call was issued. Fixes: 8ebe0a5eaaeb ("mm,madvise,hugetlb: fix unexpected data loss with MADV_DONTNEED on hugetlbfs") Cc: stable@vger.kernel.org Signed-off-by: Ricardo Cañuelo Navarro --- mm/madvise.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mm/madvise.c b/mm/madvise.c index 49f3a75046f6..c8e28d51978a 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -933,7 +933,9 @@ static long madvise_dontneed_free(struct vm_area_struct *vma, */ end = vma->vm_end; } - VM_WARN_ON(start >= end); + if (start == end) + return 0; + VM_WARN_ON(start > end); } if (behavior == MADV_DONTNEED || behavior == MADV_DONTNEED_LOCKED)