Received: by 10.192.165.148 with SMTP id m20csp3114448imm; Mon, 23 Apr 2018 00:21:12 -0700 (PDT) X-Google-Smtp-Source: AIpwx4/6qpxsrRdVeVHPIISGwlVeA3SP73qmTMpm89fo1XoTplyft/VLkL08XydgGiqrRVyPWvGD X-Received: by 2002:a17:902:b2cc:: with SMTP id x12-v6mr19648929plw.16.1524468072946; Mon, 23 Apr 2018 00:21:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524468072; cv=none; d=google.com; s=arc-20160816; b=FR7AmdhgfU1yd2gAsVMhYY90OTTq6k1GP+uHMIsiQjsr+ryMFurydxHmg3Sqr9NUxh xpxpuDBsNlQmvWblIdopJnvNk2C5O1hfcHXRILq2Y2hD0VPyppEKhUeL9/gB2g0rNUOH 78uh49xpTG6laUDyir4gBr0M5B80eA64SlKHkxW8qbnDOW9FG8ceWr+kNuH8SDMK8bLG csoVNlKsetvqfN5Hv5JDxf34EsfoImDi7TVe9ZTdELrjsptpjFmcPb7tq3JhwjGdwxkG PgdzpMjR+1IUWw2jhqrzStcWGpjdRdJ7nIN3Sw2AC9ibPDNwXBPfcaxh6kITrJBiJrLE AD0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:dkim-signature:arc-authentication-results; bh=NeTxUhIGtZosZ9O2GR81qVUI5nNuv/GImFjDt78v+2I=; b=BDXNXqM9nXJxvcLzrDDwogT/x6ZDOZWBG10idXnmv0J6mY8PmC47/Uuh1jpc+ewPte XmoZFvcLHweXmpGPxsdvUxrZP1HUqdKeKEEvmpg8Xahy5AMG1yz8rJiu+dPRPn44T29V +GDs6vmbtHk1iaAVVYQz7LtPMQEKPL/Aot86NC/R5RJPHu46xywCKftbUDS913S/Yqez LvSi65f7ZDV2NEmAAd5ccHvY8LvaC/UKhHk/xTl5HKT1myMXQjnHdJ5AKxLT+HgSzu1x 2QJhPXftWoLxtrrcNgWBIZW/1eoryDE66lPfiLse/gRFVbvqMlRqZSCPlCXhlIb6CSx5 +D0g== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b=XxDhCcFp; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id ay12-v6si10296773plb.554.2018.04.23.00.20.58; Mon, 23 Apr 2018 00:21:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b=XxDhCcFp; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753009AbeDWHTy (ORCPT + 99 others); Mon, 23 Apr 2018 03:19:54 -0400 Received: from mail-pf0-f193.google.com ([209.85.192.193]:34796 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750766AbeDWHTx (ORCPT ); Mon, 23 Apr 2018 03:19:53 -0400 Received: by mail-pf0-f193.google.com with SMTP id q9so8511317pff.1 for ; Mon, 23 Apr 2018 00:19:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=NeTxUhIGtZosZ9O2GR81qVUI5nNuv/GImFjDt78v+2I=; b=XxDhCcFp8iA1Ygc0YyExU8C1jBOssaw3IvEk0sIhbdp3WdrZbeNGYlWTV/ZZPkDRfG 2/u+wjU9HYDAPD9bWOxJewWTXve/UNlRNrIY+AVvqw+LAxM0UhZ/ZAOchBwXlXiRvmNW L4S4Sr6rzW9dmbWJyJAhDXdroeaqWWF+poYB7t+xecdzj46ywftV+B9SRv/HHyeKJeZh BoqxE2HUM2LIgg6ASMo6NdaegnVTwzygXJYfLbSjy1BK1YUW6Vv77+HQEhE7QaRxvadU GPMDmCb57RaCgxz6wtt70dg9JSt3BTKPyudzDlvY9H9dF4415ol8syBpbrzlEqYVql6N 8AxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-disposition:in-reply-to:user-agent; bh=NeTxUhIGtZosZ9O2GR81qVUI5nNuv/GImFjDt78v+2I=; b=g1Be0S0zaXzTWUUKVdqB99v4hImb04gjmAr4VABu9vwJ8JJfLKOyobLBxgbizaHXQM QMXh9zVyXQD0Ws8KFVtBv2IME9WdkixfSxqeP6y2ICZ5zdBhFR9LxYA5Yv+A/zXTG5Xr REZqEB0l0QLLIki9QK2lAOm8IAr5E7+j/U7BdAKA0zduWkcB78trEoOD/MkQcmvW1Bnm S/8IRpkNvJDeogsYuJeNMxjYN+s6QAp5p/adAyYUrPi0GVPjM63/JPSk3cdbqsT+CB9P z0XnAzOZcRxOqd4D+DVftTFCnElMK1Z/fWMXgtL56nYb0Blc2zwAtJQcrhGgb/Cordpa neUg== X-Gm-Message-State: ALQs6tCS0E0lG1KtOAUOOratO4IfxTmkIQ+KPvgW6kujpXMsssorrf8U 3t+Rpb/GTI3494x6A5ocWqg= X-Received: by 10.99.136.73 with SMTP id l70mr16489316pgd.49.1524467991949; Mon, 23 Apr 2018 00:19:51 -0700 (PDT) Received: from rodete-desktop-imager.corp.google.com ([2401:fa00:d:10:affa:813f:5380:6613]) by smtp.gmail.com with ESMTPSA id g64sm27746238pfd.75.2018.04.23.00.19.43 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 23 Apr 2018 00:19:50 -0700 (PDT) Date: Mon, 23 Apr 2018 16:19:41 +0900 From: Minchan Kim To: Laurent Dufour Cc: akpm@linux-foundation.org, mhocko@kernel.org, peterz@infradead.org, kirill@shutemov.name, ak@linux.intel.com, dave@stgolabs.net, jack@suse.cz, Matthew Wilcox , benh@kernel.crashing.org, mpe@ellerman.id.au, paulus@samba.org, Thomas Gleixner , Ingo Molnar , hpa@zytor.com, Will Deacon , Sergey Senozhatsky , Andrea Arcangeli , Alexei Starovoitov , kemi.wang@intel.com, sergey.senozhatsky.work@gmail.com, Daniel Jordan , David Rientjes , Jerome Glisse , Ganesh Mahendran , linux-kernel@vger.kernel.org, linux-mm@kvack.org, haren@linux.vnet.ibm.com, khandual@linux.vnet.ibm.com, npiggin@gmail.com, bsingharora@gmail.com, paulmck@linux.vnet.ibm.com, Tim Chen , linuxppc-dev@lists.ozlabs.org, x86@kernel.org Subject: Re: [PATCH v10 09/25] mm: protect VMA modifications using VMA sequence count Message-ID: <20180423071941.GD114098@rodete-desktop-imager.corp.google.com> References: <1523975611-15978-1-git-send-email-ldufour@linux.vnet.ibm.com> <1523975611-15978-10-git-send-email-ldufour@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1523975611-15978-10-git-send-email-ldufour@linux.vnet.ibm.com> User-Agent: Mutt/1.9.2 (2017-12-15) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 17, 2018 at 04:33:15PM +0200, Laurent Dufour wrote: > The VMA sequence count has been introduced to allow fast detection of > VMA modification when running a page fault handler without holding > the mmap_sem. > > This patch provides protection against the VMA modification done in : > - madvise() > - mpol_rebind_policy() > - vma_replace_policy() > - change_prot_numa() > - mlock(), munlock() > - mprotect() > - mmap_region() > - collapse_huge_page() > - userfaultd registering services > > In addition, VMA fields which will be read during the speculative fault > path needs to be written using WRITE_ONCE to prevent write to be split > and intermediate values to be pushed to other CPUs. > > Signed-off-by: Laurent Dufour > --- > fs/proc/task_mmu.c | 5 ++++- > fs/userfaultfd.c | 17 +++++++++++++---- > mm/khugepaged.c | 3 +++ > mm/madvise.c | 6 +++++- > mm/mempolicy.c | 51 ++++++++++++++++++++++++++++++++++----------------- > mm/mlock.c | 13 ++++++++----- > mm/mmap.c | 22 +++++++++++++--------- > mm/mprotect.c | 4 +++- > mm/swap_state.c | 8 ++++++-- > 9 files changed, 89 insertions(+), 40 deletions(-) > > diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c > index c486ad4b43f0..aeb417f28839 100644 > --- a/fs/proc/task_mmu.c > +++ b/fs/proc/task_mmu.c > @@ -1136,8 +1136,11 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf, > goto out_mm; > } > for (vma = mm->mmap; vma; vma = vma->vm_next) { > - vma->vm_flags &= ~VM_SOFTDIRTY; > + vm_write_begin(vma); > + WRITE_ONCE(vma->vm_flags, > + vma->vm_flags & ~VM_SOFTDIRTY); > vma_set_page_prot(vma); > + vm_write_end(vma); trivial: I think It's tricky to maintain that VMA fields to be read during SPF should be (READ|WRITE_ONCE). I think we need some accessor to read/write them rather than raw accessing like like vma_set_page_prot. Maybe spf prefix would be helpful. vma_spf_set_value(vma, vm_flags, val); We also add some markers in vm_area_struct's fileds to indicate that people shouldn't access those fields directly. Just a thought. > } > downgrade_write(&mm->mmap_sem); > diff --git a/mm/swap_state.c b/mm/swap_state.c > index fe079756bb18..8a8a402ed59f 100644 > --- a/mm/swap_state.c > +++ b/mm/swap_state.c > @@ -575,6 +575,10 @@ static unsigned long swapin_nr_pages(unsigned long offset) > * the readahead. > * > * Caller must hold down_read on the vma->vm_mm if vmf->vma is not NULL. > + * This is needed to ensure the VMA will not be freed in our back. In the case > + * of the speculative page fault handler, this cannot happen, even if we don't > + * hold the mmap_sem. Callees are assumed to take care of reading VMA's fields I guess reader would be curious on *why* is safe with SPF. Comment about the why could be helpful for reviewer. > + * using READ_ONCE() to read consistent values. > */ > struct page *swap_cluster_readahead(swp_entry_t entry, gfp_t gfp_mask, > struct vm_fault *vmf) > @@ -668,9 +672,9 @@ static inline void swap_ra_clamp_pfn(struct vm_area_struct *vma, > unsigned long *start, > unsigned long *end) > { > - *start = max3(lpfn, PFN_DOWN(vma->vm_start), > + *start = max3(lpfn, PFN_DOWN(READ_ONCE(vma->vm_start)), > PFN_DOWN(faddr & PMD_MASK)); > - *end = min3(rpfn, PFN_DOWN(vma->vm_end), > + *end = min3(rpfn, PFN_DOWN(READ_ONCE(vma->vm_end)), > PFN_DOWN((faddr & PMD_MASK) + PMD_SIZE)); > } > > -- > 2.7.4 >