Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 9 Aug 2022 16:07:50 -0300
From:   Jason Gunthorpe <jgg@nvidia.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     David Hildenbrand <david@redhat.com>, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org, stable@vger.kernel.org,
        Andrew Morton <akpm@linux-foundation.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Axel Rasmussen <axelrasmussen@google.com>,
        Peter Xu <peterx@redhat.com>, Hugh Dickins <hughd@google.com>,
        Andrea Arcangeli <aarcange@redhat.com>,
        Matthew Wilcox <willy@infradead.org>,
        Vlastimil Babka <vbabka@suse.cz>,
        John Hubbard <jhubbard@nvidia.com>
Subject: Re: [PATCH v1] mm/gup: fix FOLL_FORCE COW security issue and remove
 FOLL_COW
Message-ID: <YvKwhrjnFQJ7trT1@nvidia.com>
References: <20220808073232.8808-1-david@redhat.com>
 <CAHk-=wiEAH+ojSpAgx_Ep=NKPWHU8AdO3V56BXcCsU97oYJ1EA@mail.gmail.com>
 <1a48d71d-41ee-bf39-80d2-0102f4fe9ccb@redhat.com>
 <CAHk-=wg40EAZofO16Eviaj7mfqDhZ2gVEbvfsMf6gYzspRjYvw@mail.gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAHk-=wg40EAZofO16Eviaj7mfqDhZ2gVEbvfsMf6gYzspRjYvw@mail.gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Yvhh6Jff/mbq5KuuLTUE2KYIAuZJJsgLO3EepkfCHdMdZiD3S/wJQzS90smO?=
 =?us-ascii?Q?LgXNyQ3ip5uRFDO/upqGcevrsHLaTZRPO/ui9gZ5pX5sbXaysDU18awA7yyK?=
 =?us-ascii?Q?DjNu0J08yWzG8DTMnzRO95fucJ4uzoZSHlJ8/Dnrr7zgSy9tMk41EMVg6qze?=
 =?us-ascii?Q?sybe4U0smYcgHKdA17nHdlh7doXqIq+TAs06NPoMfWi8p0H60MSjGFG0E85c?=
 =?us-ascii?Q?VWEdmJZjcdvOhWu615SrMbk7xK3vMae2F5YIkwIy+pqcFOsNlpSoRa2cE0S8?=
 =?us-ascii?Q?hzmBeCW9IQcRG/q9X05YyIBt7cN3+YE1oIoFqhe9KveScyps0uTFcA3mm652?=
 =?us-ascii?Q?dD1PMefTOxlUAYQKvSEPL4Iayai8eJXjNt/qp0oqa/IRbXe1RhlYnFx7Gf1n?=
 =?us-ascii?Q?l9MDNTFeRM6xBTRIKXzO7I9sblVIqGKJOObketfuVZ2mdoh+o8nQyE3FXUm/?=
 =?us-ascii?Q?8bGJJGl/fXTK5T8qscvvaFJdMxJjAS2fu9PKEgdO/tLFAztcrjdFHqpNpBKY?=
 =?us-ascii?Q?f+ZpB66jbE+0AZQLiWFVU4sGHDCKq3/AbkJo3MftvjbFJUl6mJN7JLP21AIn?=
 =?us-ascii?Q?p15AEtxy8nNY99hZ2gOGmIdlOcbJq7GfbtWVMGWK7yJTTLX1w0xUtaGsKd8t?=
 =?us-ascii?Q?7nXdC75LO/eBJ20HI7bkDFlA6jUVd/k2nkZ938XZQ1wG3kbgimNC14UmW+tk?=
 =?us-ascii?Q?+ItmgRV8ne5nLmPyVGHWkWNCzL49mBmvbGUU2ZhRMetVbFzm4filE2/oJyvk?=
 =?us-ascii?Q?c9NvN7xU74pxzS65jkJ4pYYEHSVEaO4gJn3y875qkhbKfAHm9G20eolwTDCT?=
 =?us-ascii?Q?mz+Hdenv6VPhnpUg8Xt1kTzNPshuvVLRLvWrjU/PfZSINVga76nAMfTyfiFc?=
 =?us-ascii?Q?Bh6vAVWfUKfkL/IXH5BSyXrE3xNbX9br2K8yOFOsYDZA5r+bOzp6m0w5poV7?=
 =?us-ascii?Q?AFGbaXepFMrg7ugcIut3vDwJCWlsKWycDioT8/9Ew66DPbHeD+4itLyvxBTh?=
 =?us-ascii?Q?0oRNpz3otJInjKGLnW7YCqmcyNcOnrV4SgohcBKV03AcUuE8hOcvqLqq7Lw8?=
 =?us-ascii?Q?AJ3xhfIRgtMvQPjq7132liMO6VSIXupdB4gWPN179AqexdyL2V6tk7YJLi02?=
 =?us-ascii?Q?xybbISHQjbSQMNNEcjR7eGWWRl1xW4oJaQ7CKadQfqbeMWMNf8V7bNe/8pPN?=
 =?us-ascii?Q?bhZBifA8tCXUgStejPSMdOBZi2R1zZgrHlu+3KOMC4f5UtkymLIEBSW0qKtb?=
 =?us-ascii?Q?wcb80jIwmnaLZLYPfnwca1r85peIUmt4cnoYUIyD8xaf7EpFQNG/ccAxBXek?=
 =?us-ascii?Q?q8mUHcxWOguEezcdil7M2hYldozMoNEVvFRB/yV6ogHUBV0bfLnK7EHc5qcl?=
 =?us-ascii?Q?Cs7o5q0abRpJle2cztAUYLLnrwSLzI/AegO8j7CjIXRS8lgzOOdNdWny9v3q?=
 =?us-ascii?Q?16q3JiMAKEiacBUCDWR5hQ0fH82Pu+sBgQ8Wl6KFRe8wQ2c4H5whUHOzmxRl?=
 =?us-ascii?Q?51tBljBY4krj9WTLRZKzTqKJsyTadbVVTZrl6c4wW9+RA5goGvss6SEFF/ei?=
 =?us-ascii?Q?douzMOP/Cwnr//T23ABpVWQGcwY4Ca/iokDLZPZW?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d1374db9-575b-4ef2-16d7-08da7a3a74f1
X-MS-Exchange-CrossTenant-AuthSource: MN2PR12MB4192.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Aug 2022 19:07:51.7494
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: UthIFdQfH+DnmKIy5kcj9EjvgJmNgVPZb4BAT5kA/5bLe6bVeetfHmBgXDaY8UIZ
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR12MB2849
X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Aug 09, 2022 at 11:59:45AM -0700, Linus Torvalds wrote:

> But as a very good approximation, the rule is "absolutely no new
> BUG_ON() calls _ever_". Because I really cannot see a single case
> where "proper error handling and WARN_ON_ONCE()" isn't the right
> thing.

Parallel to this discussion I've had ones where people more or less
say

 Since BUG_ON crashes the machine and Linus says that crashing the
 machine is bad, WARN_ON will also crash the machine if you set the
 panic_on_warn parameter, so it is also bad, thus we shouldn't use
 anything.

I've generally maintained that people who set the panic_on_warn *want*
these crashes, because that is the entire point of it. So we should
use WARN_ON with an error recovery for "can't happen" assertions like
these. I think it is what you are saying here.

Jason