Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Liam R. Howlett" <Liam.Howlett@oracle.com>
To:     Andrew Morton <akpm@linux-foundation.org>
Cc:     linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        Rick Edgecombe <rick.p.edgecombe@intel.com>,
        "Liam R. Howlett" <Liam.Howlett@oracle.com>
Subject: [PATCH v2] mm/mmap: Regression fix for unmapped_area{_topdown}
Date:   Fri, 14 Apr 2023 14:59:19 -0400
Message-Id: <20230414185919.4175572-1-Liam.Howlett@oracle.com>
In-Reply-To: <20230414145728.4067069-3-Liam.Howlett@oracle.com>
References: <20230414145728.4067069-3-Liam.Howlett@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?teb+CElq38nmt14+ZaaJrU34lpCxYaSxubNPdGttyWvjn32V1Ynj4O7LAON4?=
 =?us-ascii?Q?N5S8UydgtuhyC1M52zxpsEmV5Wdf0nF8aDfvhcLkBdfp4HqlEjgL/i0qbmTx?=
 =?us-ascii?Q?Fhf3B65R2OjmSlFJMxS7OAmzE1ZH+7u3k6o+N/ztIFkjBUB8V1f6jACaHpRk?=
 =?us-ascii?Q?g6xBr+h4LmOCgckuMXbM7g+FBf2C1A1213PJWbztpvCw30KD8YDHOisCcpaq?=
 =?us-ascii?Q?l46aKR36U6oQtPuqTa9knYuFBTMZgx/3kjWek0zrLL64B++tuyxUT8UFW3Pd?=
 =?us-ascii?Q?iwgJIoAVNl45ivRouglo4DoMlZxG7TZYa3bVTtXqBoPgn3Z8nh3ddvCZzAd8?=
 =?us-ascii?Q?xQoTsl8NZ1/oaoIATgGGrBrJ5iwyNj4RZ3cyN6XQDlsVVRoXQEuV5Eulw6c0?=
 =?us-ascii?Q?8gLVF7+CPWna8SscPhLKRBWVSKkySDO99rP4/JjO+3QpoRggJg33gPrCUFBt?=
 =?us-ascii?Q?00DMMf2y6213cBQvkEYWZ4Ma0GdXpdt/Z5/R2t2FeqlMME1GKQ3flJ/+9yor?=
 =?us-ascii?Q?tVZNVt7kfqVvu+hT5wTWu0yIuwCW3jfEu40yU56pKyhdenhY27AYW05Ym8mV?=
 =?us-ascii?Q?Cu4yMyZd4GEv4peRrIJr8fbDUSz9M+KnHuiPAZgsBrfNm/zQqQEjKo8bjK8P?=
 =?us-ascii?Q?XQFYf0caua0GbGCFKvZ12brOuSqjEiD0wDonvRcxyvqBCro00jd3v2g3EPJF?=
 =?us-ascii?Q?7AJKKB33TFrc6z9uWJvxcUdbexz/EFUtjnDueIfYGcFwoWsMDj/4IKmP+JMt?=
 =?us-ascii?Q?IXslX6g9k9ClAw4y0GEWwK2rUqOiXi/aOVUIpcV8moB5m+l5o8inLJOgXSRR?=
 =?us-ascii?Q?OS1oSrV7+05ndh3tOJ+lTxN0GwDpmVEGt71/SbCQSPyNMxp3gJVmtnnn8jCh?=
 =?us-ascii?Q?aZFmUrX4Db2beJodQyjaTwXJhb5y3Otzdg93Ej/346vwgRjMV8IFf+Y2UQX6?=
 =?us-ascii?Q?COouftYHUFuloFllxi8SO/7mofH7mEpKceGCrBceW3FtGuFhjwwXxt8/lP73?=
 =?us-ascii?Q?mIrEzesvB0n4+DTyR4u+rMly0+r5XzJjRyTUGc4Q+7H2m0cajSv+8eUa8ZFh?=
 =?us-ascii?Q?6gQvWqIndDea+QQ/T7FjjgJw1kxusvA45pakZ9MVZaOEJW+8XnNf6n/7Y1yG?=
 =?us-ascii?Q?+eMR/dnn0RvLdcjQ7MHWpYdLCKbgJLsPg8BrvDU0bjPAG8AzQ03hVc/joMUJ?=
 =?us-ascii?Q?zKN/Ke4QZ4Ej3mgWmWIVwBq45Z1QWPR1snvnQ7lLkSHA9grwLmsH1kJRFwtY?=
 =?us-ascii?Q?BbMaADj5AAtrjjsSzNTfHdTQ/39wL2THycrVlEduVsQ+7ViG7MV5JMOBnW3D?=
 =?us-ascii?Q?Swwh4p801Ruk/3jSrHT/5PFSEyd5ZRP9kl7J4lG043Jc4v5yOs5p7+HPQtu6?=
 =?us-ascii?Q?SFt7hIiKuVAwTFO+XRGrorq8Neu7JVMcGOjFnoRBkn1EeGYFu1h3E/RFv+w5?=
 =?us-ascii?Q?zUFX71DMqSqzk7dpkq67qYNq5lh6CnhHaHeevZ7N8T4oqudtDAKJZxk1ohF1?=
 =?us-ascii?Q?oze7GA96oOr4nwjoo7ITHAlEIqQ/usdVWM7eQLRYn7K0n5XkYoye9aqZTSKW?=
 =?us-ascii?Q?rnoYSm6dG0khKMVVoG2Xs4vUULxkQZ81jB/CIkQXSNU2UxBFRAN8gk4kCMXF?=
 =?us-ascii?Q?lw=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: Ncrs1hw+KGddBgy2uyku1x3zywDOxgGn6V9jE9ZWBpZQWZXzw6MXViDMuDerd3IGvWt8KEGwqea0+cpohwuNkTBiRPTB8irZvla256IVynkYP4oRif0adDPzj1W3NV+R0ErChPVWQaGVhZeUiFhBpQL1lSSF9SQA0mwQsH2INb16XUfMBh0cmnJpFj15Hy8JK4F6KImqrWYz8ZZwKZP2mUhz9/GEFAqEL6jvhawaGz5YaYsNv95pFekAaxxidPHbuw+B28VrDym6Mnbe3jaCbS0nbSPKela3lpujsWt5M8Rmq52wOr98aVQivKMnwPqbTWXiy0ct263D0zQ14JtU8pOCyI1FQamwWN10wuczX0qT/urkMxoPQMxOk23Ht6yrxi3I+FaYbIx67BSXAi4Au8YseGD8pw37EQjXO96t+oU0/1cfiySkrPP9YTbxjZX8qOKGztoTWKjFZYOc/BUs07nFkUQIh+tcDc8gAjTmF8msA5cyV5lBP58X0vfw53xBfzVzu8442Q12LpB5j16XAq4bhKKWeWq7I4NjVn+qvnCLdCR6GlyrR+k+YqR0Va+CBkZDseBs1leO0nI14OnGzLumqooMjpAHRBQWuBbQgJEJNaWwlsxLwcSBUewgRAnTxX2pdBRyBgZyZdBW8mRwem/8xukpH08M/pevR5pxrkEkPsz7RwhTSfjWKt5g7FCEo/Ue0x4owLS1unxk9cwU9t6IVGRaEO0gqOmmb1yG/H3eUum4114/fS+ipD98+dO0n3HM9q3YiLISojxyU49OoYV3vhCiRupNAZOGNdJBIIP88h2KWo92UQkTQ2X0Qd3BdgW/FGLQY2YjwjEJir4FmazM1Eqmgj7rN3xFJag5g8uaSLfADSJ77qiSzBqlBdM0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c31895fe-4e47-4653-fdd3-08db3d1a5fb5
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Apr 2023 18:59:28.8387
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: bLZPJajovjXINs/JkVdnEYmddnEnrTYxrldAFvqib+ge91/37GmG2hBMLI2dUpzZo0lFH/Ob9X1xCIk7/Vyo5A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB7224
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-14_11,2023-04-14_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxscore=0
 mlxlogscore=999 spamscore=0 suspectscore=0 bulkscore=0 adultscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304140168
X-Proofpoint-ORIG-GUID: hozuoUoSJEFp9VzBVnvDtdGGMWMU2rQD
X-Proofpoint-GUID: hozuoUoSJEFp9VzBVnvDtdGGMWMU2rQD
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The maple tree limits the gap returned to a window that specifically
fits what was asked.  This may not be optimal in the case of switching
search directions or a gap that does not satisfy the requested space for
other reasons.  Fix the search by retrying the operation and limiting
the search window in the rare occasion that a conflict occurs.

Reported-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Fixes: 3499a13168da ("mm/mmap: use maple tree for unmapped_area{_topdown}")
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---

v1 changes:
 - Add comment about avoiding prev check
 - Remove check for VM_GROWSUP on prev since vm_end_gap() does this

 mm/mmap.c | 48 +++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 43 insertions(+), 5 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index 055fbd5ed762..6b9116f1c304 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1548,7 +1548,8 @@ static inline int accountable_mapping(struct file *file, vm_flags_t vm_flags)
  */
 static unsigned long unmapped_area(struct vm_unmapped_area_info *info)
 {
-	unsigned long length, gap;
+	unsigned long length, gap, low_limit;
+	struct vm_area_struct *tmp;
 
 	MA_STATE(mas, &current->mm->mm_mt, 0, 0);
 
@@ -1557,12 +1558,29 @@ static unsigned long unmapped_area(struct vm_unmapped_area_info *info)
 	if (length < info->length)
 		return -ENOMEM;
 
-	if (mas_empty_area(&mas, info->low_limit, info->high_limit - 1,
-				  length))
+	low_limit = info->low_limit;
+retry:
+	if (mas_empty_area(&mas, low_limit, info->high_limit - 1, length))
 		return -ENOMEM;
 
 	gap = mas.index;
 	gap += (info->align_offset - gap) & info->align_mask;
+	tmp = mas_next(&mas, ULONG_MAX);
+	if (tmp && (tmp->vm_flags & VM_GROWSDOWN)) { /* Avoid prev check if possible */
+		if (vm_start_gap(tmp) < gap + length - 1) {
+			low_limit = tmp->vm_end;
+			mas_reset(&mas);
+			goto retry;
+		}
+	} else {
+		tmp = mas_prev(&mas, 0);
+		if (tmp && vm_end_gap(tmp) > gap) {
+			low_limit = vm_end_gap(tmp);
+			mas_reset(&mas);
+			goto retry;
+		}
+	}
+
 	return gap;
 }
 
@@ -1578,7 +1596,8 @@ static unsigned long unmapped_area(struct vm_unmapped_area_info *info)
  */
 static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 {
-	unsigned long length, gap;
+	unsigned long length, gap, high_limit, gap_end;
+	struct vm_area_struct *tmp;
 
 	MA_STATE(mas, &current->mm->mm_mt, 0, 0);
 	/* Adjust search length to account for worst case alignment overhead */
@@ -1586,12 +1605,31 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 	if (length < info->length)
 		return -ENOMEM;
 
-	if (mas_empty_area_rev(&mas, info->low_limit, info->high_limit - 1,
+	high_limit = info->high_limit;
+retry:
+	if (mas_empty_area_rev(&mas, info->low_limit, high_limit - 1,
 				length))
 		return -ENOMEM;
 
 	gap = mas.last + 1 - info->length;
 	gap -= (gap - info->align_offset) & info->align_mask;
+	gap_end = mas.last;
+	tmp = mas_next(&mas, ULONG_MAX);
+	if (tmp && (tmp->vm_flags & VM_GROWSDOWN)) { /* Avoid prev check if possible */
+		if (vm_start_gap(tmp) <= gap_end) {
+			high_limit = vm_start_gap(tmp);
+			mas_reset(&mas);
+			goto retry;
+		}
+	} else {
+		tmp = mas_prev(&mas, 0);
+		if (tmp && vm_end_gap(tmp) > gap) {
+			high_limit = tmp->vm_start;
+			mas_reset(&mas);
+			goto retry;
+		}
+	}
+
 	return gap;
 }
 
-- 
2.39.2