Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <65e79cf8-8713-4d2d-7a50-76d7e2aa454a@I-love.SAKURA.ne.jp>
Date:   Sat, 15 Apr 2023 19:36:06 +0900
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [PATCH v2 3/7] mm/gup: remove vmas parameter from
 get_user_pages_remote()
Content-Language: en-US
To:     Lorenzo Stoakes <lstoakes@gmail.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org
References: <cover.1681547405.git.lstoakes@gmail.com>
 <631001ecc556c5e348ff4f47719334c31f7bd592.1681547405.git.lstoakes@gmail.com>
 <b4706369-f97c-8b78-f194-b45a870114e1@I-love.SAKURA.ne.jp>
 <63d92734-2185-439c-bbc7-53a4720f5d4a@lucifer.local>
From:   Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
In-Reply-To: <63d92734-2185-439c-bbc7-53a4720f5d4a@lucifer.local>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2023/04/15 19:14, Lorenzo Stoakes wrote:
> On Sat, Apr 15, 2023 at 06:52:41PM +0900, Tetsuo Handa wrote:
>> On 2023/04/15 18:08, Lorenzo Stoakes wrote:
>>> @@ -475,10 +474,14 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
>>>  		gup_flags |= FOLL_SPLIT_PMD;
>>>  	/* Read the page with vaddr into memory */
>>>  	ret = get_user_pages_remote(mm, vaddr, 1, gup_flags,
>>> -				    &old_page, &vma, NULL);
>>> +				    &old_page, NULL);
>>>  	if (ret <= 0)
>>>  		return ret;
>>>
>>> +	vma = vma_lookup(mm, vaddr);
>>> +	if (!vma)
>>> +		goto put_old;
>>> +
>>>  	ret = verify_opcode(old_page, vaddr, &opcode);
>>>  	if (ret <= 0)
>>>  		goto put_old;
>>
>> This conversion looks wrong.
>> This causes returning a positive number when vma_lookup() returned NULL.
>>
>>   * Return 0 (success) or a negative errno.
>>
> 
> In reality it shouldn't be possible for vma to return NULL, I'm adding the
> checks to be extra careful.
> 
> In any case you're right, attaching a -fix patch to avoid spam:-

If you want to return -EINVAL when vma_lookup() returned NULL for whatever
unexpected reason, returning -EOPNOTSUPP in below path looks strange.

> @@ -448,7 +448,8 @@ static int __access_remote_tags(struct mm_struct *mm, unsigned long addr,
>  		 * would cause the existing tags to be cleared if the page
>  		 * was never mapped with PROT_MTE.
>  		 */
> -		if (!(vma->vm_flags & VM_MTE)) {
> +		vma = vma_lookup(mm, addr);
> +		if (!vma || !(vma->vm_flags & VM_MTE)) {
>  			ret = -EOPNOTSUPP;
>  			put_page(page);
>  			break;

Also,

> @@ -5591,7 +5591,9 @@ int __access_remote_vm(struct mm_struct *mm, unsigned long addr, void *buf,
>  		struct page *page = NULL;
>  
>  		ret = get_user_pages_remote(mm, addr, 1,
> -				gup_flags, &page, &vma, NULL);
> +				gup_flags, &page, NULL);
> +		vma = vma_lookup(mm, addr);
> +
>  		if (ret <= 0) {
>  #ifndef CONFIG_HAVE_IOREMAP_PROT
>  			break;
> @@ -5600,7 +5602,6 @@ int __access_remote_vm(struct mm_struct *mm, unsigned long addr, void *buf,
>  			 * Check if this is a VM_IO | VM_PFNMAP VMA, which
>  			 * we can access using slightly different code.
>  			 */
> -			vma = vma_lookup(mm, addr);
>  			if (!vma)
>  				break;
>  			if (vma->vm_ops && vma->vm_ops->access)
> @@ -5617,11 +5618,11 @@ int __access_remote_vm(struct mm_struct *mm, unsigned long addr, void *buf,
>  				bytes = PAGE_SIZE-offset;
>  
>  			maddr = kmap(page);
> -			if (write) {
> +			if (write && vma) {
>  				copy_to_user_page(vma, page, addr,
>  						  maddr + offset, buf, bytes);
>  				set_page_dirty_lock(page);
> -			} else {
> +			} else if (vma) {
>  				copy_from_user_page(vma, page, addr,
>  						    buf, maddr + offset, bytes);
>  			}

not calling copy_{from,to}_user_page() if vma == NULL is not sufficient for
propagating an error to caller.