Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 13 Jul 2022 16:36:33 -0700
From:   Mike Kravetz <mike.kravetz@oracle.com>
To:     Axel Rasmussen <axelrasmussen@google.com>
Cc:     Peter Xu <peterx@redhat.com>, Miaohe Lin <linmiaohe@huawei.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Muchun Song <songmuchun@bytedance.com>,
        Linux MM <linux-mm@kvack.org>,
        LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] mm/hugetlb: avoid corrupting page->mapping in
 hugetlb_mcopy_atomic_pte
Message-ID: <Ys9XAbuxkDUlnmv0@monkey>
References: <20220712130542.18836-1-linmiaohe@huawei.com>
 <Ys2xyCUnqpJt0eIo@monkey>
 <Ys7ViSsOxLaQJIfy@xz-m1.local>
 <Ys7uXHdzzFezUub5@xz-m1.local>
 <CAJHvVcgqb6R6ePMbgmA8LpMpMgrGWie9ZCTuR4MA77GTvi4XAw@mail.gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAJHvVcgqb6R6ePMbgmA8LpMpMgrGWie9ZCTuR4MA77GTvi4XAw@mail.gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?cniCSEiKGUTY2Pb7EHSC4M5nJzDbSpPKxvFTNrtC2LCr2nRGFWchR3lppZEj?=
 =?us-ascii?Q?hn5kIMps5lJ/D/Z5DffaF2uNzCxHlAStFEpOBQgy8zrmouczc4CBP4C0Bqwn?=
 =?us-ascii?Q?6MHnGUcET6yqk+T0j7r2Qf12PlVmjSy1Knb4KF5E08iw6dka94R/F0IbIjJR?=
 =?us-ascii?Q?Ri5Rcu2fpSp1yQrIzT0AdL/NGqMnObDefP545TORfvYrHUm9Jioyp2G/e0ue?=
 =?us-ascii?Q?29rGrcsJ1/7Zqz65q+ihof8leHBSCnHvmGq+quPC6RNQqgvgtE6UuFTFvoeC?=
 =?us-ascii?Q?LCqb0yQxneU0GHV9S9Xqpg2euqZJGN5Mfa6r6Nd/yLZGTMTaDVXZ1zha8sEm?=
 =?us-ascii?Q?r9u0oskvqcS876cAAlowo9UgDHVvJgJZND47h2T97p5aVOQk5DSl07kmc0RR?=
 =?us-ascii?Q?Ag5jtYhw6XpLfPz43zQC204MLCZKmNSpIIBcongfh696T6zjK6APjiYSupik?=
 =?us-ascii?Q?xe5z1XcGWZEDuS1BROeAXt51g9Yq2k0VXCtowe2taIj5bwVdpc1wuLATkmT+?=
 =?us-ascii?Q?LhLKHIv3y1WtByfVX0LoK5eqEYMcRhDC1RkpeLYZFXSzNYsnEfUCz0kaVoYV?=
 =?us-ascii?Q?KVVb31U1tiVMVAx2ZQnB64X49J0N9ai6yRpghbIaTdIiEV+N534njYpV+M89?=
 =?us-ascii?Q?Xh3+c6R4jioVWsnGhg67d+JANvESILc7UWT5o7mS/8dg4TayfvpW5CGTqDot?=
 =?us-ascii?Q?2JI1T9HpdPWB/Qc4sl9UMRtsBV2D0Bf3eV+r+pf7BtV6WQRy5HtCIVL+gvco?=
 =?us-ascii?Q?f79ZUeQORdTa0BWfiMDzSyEQ0smjAy9L4/V5wPYRwsmnmwOGKkcCTj+8VUSE?=
 =?us-ascii?Q?4Mt8DFbI0u7YiOaIfJOODSyejLaz7BDmv7L0+H52eHTfgifGkUojsECqXjkL?=
 =?us-ascii?Q?3zfsb9BBKrJDwioenT2fM7HsXad62WEP+9uYf/bAf/qU2wefLFxhNw4Uynjh?=
 =?us-ascii?Q?S+pYt3qmQ/D7AHroO+fRR5Rt4Sw0dMmR0iJWcqcM5WuYubIE6B7ei/CgYKs2?=
 =?us-ascii?Q?T+cKGAQOMoW8sEypb3VaKw4hnZtLM94FwGuFJguXxJWzuN+s7kWk78ag6rAt?=
 =?us-ascii?Q?cF803UavrWDpBDRp4zVUUYxUFzgdW0spQO2R8GpHNDOAYe4KpPuxMEDCaETS?=
 =?us-ascii?Q?zgHhcVulyebNNFbZz06MJhskU3DVcABnT9srFV61CCN0fkE2sHaOSRX4hUr3?=
 =?us-ascii?Q?7NilJ+rPYiEXb954n5QsZs6+E04QOPzUnCeqIIp/YQ5L0+HoRQyOEoPP88YB?=
 =?us-ascii?Q?XILhn8mwtdp72Kjx1414OvJ0F3uP+7NMFaU+nI5YRBBrni6L9jidgT0FbG/B?=
 =?us-ascii?Q?G1bSO2JMbtS6N/PVyuf2bPJ76AmRupF8dWL8z8MNYuFzKQFT1Mj1wL6GblkW?=
 =?us-ascii?Q?zFNeVLDEnW/viD1Hl2t1obayBcf2QIgO//WGJmnhDuvoZd9s9UblSAnGqEdA?=
 =?us-ascii?Q?R1nSJ+k2WZ6aMRemsMtx51AKqALDSIdqgRt0EtGfKFBweurjxt88CaUAEIES?=
 =?us-ascii?Q?SnEB7US6jD5NLRVM0h/UtcI8LBXmp/B5ufMpdcYARa40RXL7Z9FOd1KkQYZ7?=
 =?us-ascii?Q?hXrPEscCEpSg5xbKC+CYDRIKqXlY/v5HgoR/PGGQuwvi4sJt11XC5xPFiFP4?=
 =?us-ascii?Q?ig=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fec1f4f2-052d-4abe-f498-08da652886c3
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4196.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2022 23:36:36.2307
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 1n6zdArgEQg2x/31soklKmIUSeFCr0kBvHOl1dMTCl0jq5etknEwJWJJdLwX5J16BaAsjwdW2YDZn1UvfbRoPQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB6084
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-07-13_12:2022-07-13,2022-07-13 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 phishscore=0 mlxscore=0
 suspectscore=0 adultscore=0 spamscore=0 mlxlogscore=999 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2207130094
X-Proofpoint-GUID: np3NkJGnidOxyW592hdXg0tlFIvtPLYk
X-Proofpoint-ORIG-GUID: np3NkJGnidOxyW592hdXg0tlFIvtPLYk
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 07/13/22 15:46, Axel Rasmussen wrote:
> I think there is a small mistake in this patch.
> 
> Consider the non-minor-fault case. We have this block:
> 
> /* Add shared, newly allocated pages to the page cache. */
> if (vm_shared && !is_continue) {
>         /* ... */
> }
> 
> In here, we've added the newly allocated page to the page cache, and
> we've set this page_in_pagecache flag to true. But we *do not* setup
> rmap for this page in this block. I think in this case, the patch will
> cause us to do the wrong thing: we should hugepage_add_new_anon_rmap()
> further down, but with this patch we dup instead.

I am not sure I follow.  The patch from Miaohe Lin would not change any
behavior in the 'if (vm_shared && !is_continue)' case.  In this case
both vm_shared and page_in_pagecache are true.

IIUC, the patch would address the case where !vm_shared && is_continue.

On 07/12/22 21:05, Miaohe Lin wrote:
> In MCOPY_ATOMIC_CONTINUE case with a non-shared VMA, pages in the page
> cache are installed in the ptes. But hugepage_add_new_anon_rmap is called
> for them mistakenly because they're not vm_shared. This will corrupt the
> page->mapping used by page cache code.
> 
> Fixes: f619147104c8 ("userfaultfd: add UFFDIO_CONTINUE ioctl")
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> ---
>  mm/hugetlb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 8d379e03f672..b232e1508e49 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -6038,7 +6038,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
>  	if (!huge_pte_none_mostly(huge_ptep_get(dst_pte)))
>  		goto out_release_unlock;
>  
> -	if (vm_shared) {
> +	if (page_in_pagecache) {
>  		page_dup_file_rmap(page, true);
>  	} else {
>  		ClearHPageRestoreReserve(page);

-- 
Mike Kravetz