Message-ID: <5193efe2-7c49-2490-7d17-030088fe6f55@oracle.com>
Date:   Wed, 25 Jan 2023 16:01:05 +0000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.6.1
Subject: Re: [PATCH v10 0/9] KVM: mm: fd-based approach for supporting KVM
Content-Language: en-US
To:     "Kirill A. Shutemov" <kirill@shutemov.name>,
        Sean Christopherson <seanjc@google.com>
Cc:     Chao Peng <chao.p.peng@linux.intel.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org,
        linux-api@vger.kernel.org, linux-doc@vger.kernel.org,
        qemu-devel@nongnu.org, Paolo Bonzini <pbonzini@redhat.com>,
        Jonathan Corbet <corbet@lwn.net>,
        Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Joerg Roedel <joro@8bytes.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Arnd Bergmann <arnd@arndb.de>,
        Naoya Horiguchi <naoya.horiguchi@nec.com>,
        Miaohe Lin <linmiaohe@huawei.com>, x86@kernel.org,
        "H . Peter Anvin" <hpa@zytor.com>, Hugh Dickins <hughd@google.com>,
        Jeff Layton <jlayton@kernel.org>,
        "J . Bruce Fields" <bfields@fieldses.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Shuah Khan <shuah@kernel.org>, Mike Rapoport <rppt@kernel.org>,
        Steven Price <steven.price@arm.com>,
        "Maciej S . Szmigiero" <mail@maciej.szmigiero.name>,
        Vlastimil Babka <vbabka@suse.cz>,
        Vishal Annapurve <vannapurve@google.com>,
        Yu Zhang <yu.c.zhang@linux.intel.com>,
        "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
        luto@kernel.org, jun.nakajima@intel.com, dave.hansen@intel.com,
        ak@linux.intel.com, david@redhat.com, aarcange@redhat.com,
        ddutile@redhat.com, dhildenb@redhat.com,
        Quentin Perret <qperret@google.com>, tabba@google.com,
        Michael Roth <michael.roth@amd.com>, mhocko@suse.com,
        wei.w.wang@intel.com, Liam Merwick <liam.merwick@oracle.com>
References: <20221202061347.1070246-1-chao.p.peng@linux.intel.com>
 <Y8H5Z3e4hZkFxAVS@google.com>
 <48953bf2-cee9-f818-dc50-5fb5b9b410bf@oracle.com>
 <Y9B1yiRR8DpANAEo@google.com>
 <20230125125321.yvsivupbbaqkb7a5@box.shutemov.name>
From:   Liam Merwick <liam.merwick@oracle.com>
In-Reply-To: <20230125125321.yvsivupbbaqkb7a5@box.shutemov.name>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?K1JkcnU2YURKK1p1U01hZU1DSzEvTk1zWWxhekpJb3VzSExGN3F3RGt1cFd5?=
 =?utf-8?B?NzJYME9PZXB1b3d1VXJQRFVtQ0s1elU4WGhMNnlQdWE2L1Jjbkl4RlhRb1ZK?=
 =?utf-8?B?M2NOS3FBWmFNREZQd0RLcUREQUpyZ1BqYWtsV0pWQzkrL2tjaEpZK1hCdnJJ?=
 =?utf-8?B?MmdLNC8rOFpiRC9zMUIrVVRWRGFaeTBGTUFBdzQxdjFiWUVTKzhZN0FibXZx?=
 =?utf-8?B?U2R6TzVERTkrYWE4MzYyVEhLZmlqTEoyOUNzWEZXR0xmVHRWdnNFY2tHUDJz?=
 =?utf-8?B?QXQ3Y0ltMFdzVXZMaUpZK3l2NGlldHU5VnY5NWNsaW1sdkl6anN1bTh0WHBL?=
 =?utf-8?B?aE9CMS9kSnhYSXhFREJHM2JaVFRVcjQ1cHo3SHhVdWlxa0ZyeGFOLzA2cHdv?=
 =?utf-8?B?WTJ0QmdxTEVkUWJ6VzQxN0VJMnhjVkxndlJ0Y1ZKMzJoZHQ5Nnk0NHZucmcr?=
 =?utf-8?B?bGxSTVREaGlHRlNyTTViLzNrYVpURWRPaVRjYzdFU1hPd2d6TDBZQzBYd3l4?=
 =?utf-8?B?anZ5c2RGQTlPSlF5T0NRQlhRaGJMTWRsRW1WVVdkNllyaTkrdnR0U1Noc25v?=
 =?utf-8?B?M210UUFGK2k4Q2VvR25sOEYzUUtXRk82VGQ5QmVFVzRxaHkwM1dXRHdaODhh?=
 =?utf-8?B?ZFF3WVIzMm84bitsOVdzdmVlMXlOamFQMTM5VWprYUNsLzVYRUNaZEdpOXNP?=
 =?utf-8?B?c0NFTFc0L1NiTGZLM0p6YTlZSm5FLzRMMmlpV3BkYzBtY3BDR1JXdnZzUjBO?=
 =?utf-8?B?RTdNenRoZGZCSWdaY0NySzFaVEZEb3NJTHJRMy9DZEh6T1JSMFpNUUo2TUFj?=
 =?utf-8?B?Y0l3ZEZFbWFkdW5heXZNZ1Y5bTBqajJBdkJ0SDNoWlplZTFraWhmWEVpbDJy?=
 =?utf-8?B?TEEvNWNnbTZtdDVDQ3BZWXZsUDBYRVJDY0xPTVY4UGxvaHY0QS9aMHczRWFW?=
 =?utf-8?B?aklVUUxZVnlmSU5kcnNPejYzSWd3SDhOT28xSHJrKyswUE5tSU1hQjNBQk9h?=
 =?utf-8?B?dUIweGV5cEVTZHlxM3l2SDlKajkvVUw3SHRmU243OW5YMlhoZk0vNjdJc0dG?=
 =?utf-8?B?TW5GMlRpSmZXaWcyOVVTeWttamw1dFZ3bFczdVY5YTFWNCsrQnIrMUtlT01l?=
 =?utf-8?B?bDBOcDBIMWw2dU91U0c2Vk43b3NnZzQxZnRsVGxjUFpMUGZzbzJYcGIvUmxs?=
 =?utf-8?B?SnlaUm4weUl5eWhTZDJuajdBVXNMV08vdHZhNlk5L2ZHVlNMczF1dXRDS0VW?=
 =?utf-8?B?SmFNT0FoNlkxdS9uM1Rld1NDRGF1NVE5dENtSDdyQitOdURhSTBMbDFtVmJR?=
 =?utf-8?B?WVNITGZ5cG9Xc3ZmclVxeUpKOUNvNHBOSEU2S2NnRjFwWVAvTkd6cnE5WDRZ?=
 =?utf-8?B?TGdkSDR2N3ZBc29nejZoNGhVZUU2RWVPVnE5TUZVM1BjU1k3M281blFrdDBW?=
 =?utf-8?B?NXR3TXVkc3BLRExhcXJJaHB5RVZOZ2MydEh5M0hydS8rQUdrd3gvMWV3MUFF?=
 =?utf-8?B?eStFMnMwN2xhNG5KZVhLUFc3eVpMVXcrSkpOZXB5NHNxcExQcEdYTjJmTEti?=
 =?utf-8?B?SzJVYWs1KytxNG5NRHU2VW9uN2tTeWFGekJWZmV3N1RmUmd3V0llK2oxOU1s?=
 =?utf-8?B?Z003dC9YLzQvcno1VTlKQjZ6TG1PUlRXSXppeWd0dUhJTjZyeHNFcXR2MjFa?=
 =?utf-8?B?d2JTa0lGRzJHMTV0TmkzZzBFVkY1UWVDakhkU1N1S1RJSmlzRHFIZXhyMER4?=
 =?utf-8?B?Vzh0eFFSTmtJSEIzOEpmaERQUXJRenR3ZkdiU1hQYlhicGVFbUswdGljdXY4?=
 =?utf-8?B?WmsyU0VlMCtjdXZwcUxsM3BUWkhLNFZkZjhraTk0Y0VnaGMwNHc0YU8vNm1U?=
 =?utf-8?B?V0VaaXBuRUJrRjN3cVB0aGlvUmdzbHh1dXA0NmxPT2k2MU1GSHBvVFpBU212?=
 =?utf-8?B?dDNJZDU3bjNieVRXN0liWDE4eWtIVDR1UEtrSVpvSit5WUppM2wxNGt2UmJw?=
 =?utf-8?B?Z0VsNklwOG4vNTl4T1dzMU1MK0VlRHhIL2VCbVZLSlloQlhuUXZQRlZlU3Ra?=
 =?utf-8?B?MUprbmR4VW10NTBRQk5NS3liWGRTdjdHWDk0MkVvWENYN08zSW0zemlzeFRn?=
 =?utf-8?B?cldUL1hWQzNPaDdNTnhjRG5jK0M1VHB3RGpnOWlsMXdydzVMS1M2OUYraTg3?=
 =?utf-8?B?emc9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?bFpRMlUyNDBvdElVcHo3QzF3SVExMm1NSy9sV2NoWHpRYWZMZXhZT3JYeFpB?=
 =?utf-8?B?WEE0TzUzYzVzdHlMTGdJaEc4K0ZWWHJ0ZVlITjBVZEh6ZTNBY24wNEdkQjFt?=
 =?utf-8?B?RzFYemxtcitTb242VXdyalZ4K2ZTVFZoNFE1bzhkeHE0SXpkaTZPdVhTQlZk?=
 =?utf-8?B?a0s0d3FhSVFKa1k4Lzd1Q2QvWkJIWGxDeWM5VW5JQXNyaU5pRElrQjcxYzZz?=
 =?utf-8?B?blY2d2kvS0V3a3pZN2lwNDFKN1o0L3BvZmMySFBmTUoySDh4MDhmNHlObEIz?=
 =?utf-8?B?U0g3OUVJaFJ1bDFjeXNzMjFiTXFiYzliKysxTGxmY2FIY012Z3ZUYjE0SHRx?=
 =?utf-8?B?bzZFaDhlK1RWN3FyZTFjMnRhcEJGME1KdDJ3QjZDWGlXR0tHWU94bjhsNlIr?=
 =?utf-8?B?SThCQk5jZkFVWXg3Wkp0MVlra210WGJXZGJDZWhvbzF5ckFpdzJRem9lVmxS?=
 =?utf-8?B?S0VONy90eWMyR3pvTDI5djlOVW9QdVNpbHQ0Q3RvNS81UzFqdDZHVVJJakE5?=
 =?utf-8?B?TWljbkQ4SXYvSzZ4MU5pcjQzTTRzcUlvbjl0T1ltL1BISjdMZkp6TUVLZDZW?=
 =?utf-8?B?ZGY1ZzNTM1p5VWU2WXh4bllETmRXWUpqV1ZHTWRET1h6YVFza2FNdWQwZDFm?=
 =?utf-8?B?aEZkdEUvUnFGM2xIVzdNSnFGRDVFUUdXWW5VRHdRYmNVaXRiRFVybG83ZnRG?=
 =?utf-8?B?SW11bTVqZURaWWhIRXhDZUNXZUpJTUhEM05jNDNHWnFQbjN6MWQ1blk3RXpN?=
 =?utf-8?B?emFBYk04WTIrU3M4dmpycFFEc0czWmtSdHJEZ0Q2RVg5MDdzUE1lUHFTMU8w?=
 =?utf-8?B?aTIwYVJBOG4yaDBTVXV3d3dEZlB1cURMOTE4L25yeG5yc2ZpRXg1VVY2NDlV?=
 =?utf-8?B?TmZpbTJ4R1EvbU9jTEs3aWZpZTR2RHZJSHFQdlRhcFdXdlVJaVZYblgvUEYx?=
 =?utf-8?B?VUI3M1lGTGVWZWJzZmNMc0lqeGphTHFiamNVKzhkZDRnNG8wNzlLci8zRVY1?=
 =?utf-8?B?RTMrV0I3amt2M29XQXQvOENWOTlNSkNYK2ZDWGxKY2lqSFc3dkxQSjlaeG9y?=
 =?utf-8?B?OGl1aVl1MUNPQjA5Y1Z5N1g2UFZQbkRIeVNKcngyUzdpUUd4WkhVNGV1YTJv?=
 =?utf-8?B?azdZNSthbUx3UkJiZnFqbThCckZLdWdwRzRWdy9NZmVTTEVvR0M4ay9kaWR1?=
 =?utf-8?B?MEw3eUhTc3pYdys1ZmxHK1hOWkZyUXZ5bkJUbVJ0aVBqSDlEYkV0U1ZSMnpj?=
 =?utf-8?B?ejVCOTF6ZE80UnhvVlVLN2o3b3pYdy9ud0p6aTl6WTlSLzdGK3YyZG5JYlNv?=
 =?utf-8?B?ZnVNL0JSUnpuUmUvVE5mcGhTL3ZjeWdDTnJPUzNZN2o5cFk3dEdGZ203bStq?=
 =?utf-8?B?NG4vSHE2V0ZxeWVSWk1VaHlGQ0FIOEFhQWhQM2k3ZFhIS1JYRzIwV3Q0a2p0?=
 =?utf-8?B?QlpDQ2YrUCtrblJFc25DQkRQQm9iRjFhbWVmSW9oVjdwaFRvWmNxVUorZVpk?=
 =?utf-8?B?QktnSmdsL1YrbTQ0WjM3OCtRREdnUk4xNVJMUVFxK2tHY3orRTZsbEFjRndu?=
 =?utf-8?B?eDQvUU9jQUoyUXlqYWNSeW9sUkt2Tk05cGtud210bjl3Zkt4L0FMRlBIbDVu?=
 =?utf-8?B?bE4zYWVFS09KVjZqekdMbEtZMjBKbENPdERIempmak1Bc1pKMzcybjBscS9Q?=
 =?utf-8?B?dmpROE82VmZCT3BMNVFTVnpyVThHMUpjaHBVQ3d3Zk1RdnV2SEJYbVRSL1Ji?=
 =?utf-8?B?bTg5bmRVUWdzR3BZWklRSmhMQ2thR3h6N1Z5cElsdC9QZUU5TTNZVXJ4TFJj?=
 =?utf-8?B?V2VGSm1FUnRhSVFxeE1aNFZUU0hhY2FIVjZQdXlybitZVFplblNnb2RMWkJV?=
 =?utf-8?B?cUJoNWxYN2kyWmZpWk1FTXpnN2pYenVucG40UFNGaXpzSmV5RzJXUjZ4NzJR?=
 =?utf-8?B?ZmpOSUR0eDcvUTlkanMrZnhUbDB1WHB2dmlIMU1ndlFoTTRsRVpNb1l3dVdk?=
 =?utf-8?Q?RDsTCPjTmd4TcnGcRAoEXJE3DEJrrM=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 70c5729b-dee7-41b9-6e13-08dafeed6464
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5030.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jan 2023 16:01:17.4947
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: DkBtNn406g47yCfIhpCPSdQlN3C7ebfj5WbaQOb6G/MqPXiM5pcrhRL2P+ssjgcnUtMRiu0OkKvtGIRzdYcEDQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR10MB6005
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.122.1
 definitions=2023-01-25_10,2023-01-25_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 phishscore=0
 mlxlogscore=999 adultscore=0 mlxscore=0 suspectscore=0 spamscore=0
 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2212070000 definitions=main-2301250143
X-Proofpoint-GUID: w751XtEoQ50sDGPrHmiILrayNAx7g2ok
X-Proofpoint-ORIG-GUID: w751XtEoQ50sDGPrHmiILrayNAx7g2ok
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 25/01/2023 12:53, Kirill A. Shutemov wrote:
> On Wed, Jan 25, 2023 at 12:20:26AM +0000, Sean Christopherson wrote:
>> On Tue, Jan 24, 2023, Liam Merwick wrote:
>>> On 14/01/2023 00:37, Sean Christopherson wrote:
>>>> On Fri, Dec 02, 2022, Chao Peng wrote:
...
>>>
>>> When running LTP (https://github.com/linux-test-project/ltp) on the v10
>>> bits (and also with Sean's branch above) I encounter the following NULL
>>> pointer dereference with testcases/kernel/syscalls/madvise/madvise01
>>> (100% reproducible).
>>>
>>> It appears that in restrictedmem_error_page() inode->i_mapping->private_data
>>> is NULL
>>> in the list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list)
>>> but I don't know why.
>>
>> Kirill, can you take a look?  Or pass the buck to someone who can? :-)
> 
> The patch below should help.

Thanks, this works for me.

Regards,
Liam

> 
> diff --git a/mm/restrictedmem.c b/mm/restrictedmem.c
> index 15c52301eeb9..39ada985c7c0 100644
> --- a/mm/restrictedmem.c
> +++ b/mm/restrictedmem.c
> @@ -307,14 +307,29 @@ void restrictedmem_error_page(struct page *page, struct address_space *mapping)
>   
>   	spin_lock(&sb->s_inode_list_lock);
>   	list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list) {
> -		struct restrictedmem *rm = inode->i_mapping->private_data;
>   		struct restrictedmem_notifier *notifier;
> -		struct file *memfd = rm->memfd;
> +		struct restrictedmem *rm;
>   		unsigned long index;
> +		struct file *memfd;
>   
> -		if (memfd->f_mapping != mapping)
> +		if (atomic_read(&inode->i_count))
>   			continue;
>   
> +		spin_lock(&inode->i_lock);
> +		if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
> +			spin_unlock(&inode->i_lock);
> +			continue;
> +		}
> +
> +		rm = inode->i_mapping->private_data;
> +		memfd = rm->memfd;
> +
> +		if (memfd->f_mapping != mapping) {
> +			spin_unlock(&inode->i_lock);
> +			continue;
> +		}
> +		spin_unlock(&inode->i_lock);
> +
>   		xa_for_each_range(&rm->bindings, index, notifier, start, end)
>   			notifier->ops->error(notifier, start, end);
>   		break;