Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) client-ip=2620:137:e000::3:8;
Date:   Thu, 2 Nov 2023 19:37:37 -0700
From:   Mike Kravetz <mike.kravetz@oracle.com>
To:     Rik van Riel <riel@surriel.com>
Cc:     Edward Adam Davis <eadavis@qq.com>, akpm@linux-foundation.org,
        linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        llvm@lists.linux.dev, muchun.song@linux.dev, nathan@kernel.org,
        ndesaulniers@google.com,
        syzbot+6ada951e7c0f7bc8a71e@syzkaller.appspotmail.com,
        syzkaller-bugs@googlegroups.com, trix@redhat.com
Subject: Re: [PATCH] mm/hugetlb: fix null ptr defer in hugetlb_vma_lock_write
Message-ID: <20231103023737.GC3531@monkey>
References: <3382634358afa9b95dc4f6db8a53a136d4b9e9cb.camel@surriel.com>
 <tencent_164A247533766D667C3D873798968236C409@qq.com>
 <20231103022426.GA3531@monkey>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20231103022426.GA3531@monkey>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Th1rYazXbF+mXFgG1qO3XBpcxJ3Zh55g7pxtF70QTsmgtoByX/wOa8hHdwFa?=
 =?us-ascii?Q?YNXV7PsaaeGHnnvebrd+c5KeL0HQ5XKIo4E2TFkZK5rCbhAUIOysr4I0vEN5?=
 =?us-ascii?Q?L+o7Ilza9dtxqPpzum8OxNGfM+hYV3KcB8BQar4P61VmteJQD6D4VBfwBmIv?=
 =?us-ascii?Q?5/TCPHMuh2iOZqk36yw5p375h+2/dS59L7wEU35F9UGy0vsRUib0FVAbdjJt?=
 =?us-ascii?Q?NV3M7q6CbRugBurmt8siPIPFi37xMHtxNKSCw3X4ne5ld17gw7huIRGyQuXB?=
 =?us-ascii?Q?qAU2QYOKwpcXsgcA1rCQHGi4joTkaZOmAzg5GkuJgNbLJqvOAd4gDQpC4/Cb?=
 =?us-ascii?Q?oaffJXA0Ih05byW5XAO2mUFs44w3vdkwL1aVbswY8WKcgOs+vS1RKzemNv78?=
 =?us-ascii?Q?nulavaOZ/1IbvhufWQzaghzBYSIvs6sXuxvsiyFLRdmu/G9IetmfNNMEoqjD?=
 =?us-ascii?Q?uQua9Qx7FknAdMUZj+KW4uKdCM9RCh+q7avTebit/jNjhtKP14p0p3gflkRq?=
 =?us-ascii?Q?KOjp+7bykImfd7kqWlMwqcPkXIAubzrPbrfqWH0/2TgSP6sdWCaL2678cirL?=
 =?us-ascii?Q?IccAYzpO+JYBxpnafbT6HXJLg/CZFABJtXHfHfjmfQeW9K4IuSMPTElN+VRB?=
 =?us-ascii?Q?oXWNZbi+cMKnvuVJGYBJw0eYW/VvSXAlnJiHntYbtQwoUMZo3k08oD4kO9cS?=
 =?us-ascii?Q?RmTVup8nniNHB2h3jX6RcLy0yDK3JxCdr4yn3Q9VpMpQjSz6/DyYyTgR2/Gx?=
 =?us-ascii?Q?nq56u7nSrPRJ10AJ1m7M1WvqYD29BQJzt2dkFKdM8n1aZ0tXdgwoCVi9VTQi?=
 =?us-ascii?Q?MJmOY9gqCSMM3DwTS9sawvizEDhveAmu0RhWmCo095PimUjXkh+2KESYwHPi?=
 =?us-ascii?Q?w71T0BV2ViyHcb6ZEc1DpVcYw1o34ocTd1LrlfM1BBkFlvJOkd+I2kBnttFz?=
 =?us-ascii?Q?6ukgVaX46IY28ZayPI/2DsIYmgS1YAfm2V2I3DwJSTi86kSH39K7MqMJyogb?=
 =?us-ascii?Q?DQ0UeIR0ibqIW9mju/n3i3HxSxVxTLZJKIKse1r/1BLUxszSarfqC+15jNR/?=
 =?us-ascii?Q?LOQGLFW4mC9z6N2XAosqWGrn0q3BBBTyJQO5hdQofx0uK7GP7zUZg1ZJhYye?=
 =?us-ascii?Q?1Soeij8X67NLWK4zjYmksDrg+Kt5P+Mpv1G0QkDzmGprsVoJwE7vaQZOI+IN?=
 =?us-ascii?Q?3iyRIGm/smSz9Qj228oDwEjHwcHU4mu/L6sC/u59oTg3xYM2ZthDsla7A/Cq?=
 =?us-ascii?Q?3HQrC6vXv5lZPqR3Rf4ytRwrRQwbYA29KWKIEzTFGK2IY9jKHLCNghFhOtef?=
 =?us-ascii?Q?+ylwBFGNxrpvMgQbXj61X0TieH013R0W9iIcTYCpOpc8YScZriBiN+ctOyy8?=
 =?us-ascii?Q?pJBUA1yDCf4iSirtCm0EEopIReK4oAaJMhaxWOCo3rvI0OBKZmDyNmXq8bVM?=
 =?us-ascii?Q?8Y9+wP/AwGMT9fddX7wjc0GGZXe5IsM/dUDMoSmjZw6u4ZpDXneYCoQb4fz3?=
 =?us-ascii?Q?lpImCAGTYxZMY4X5Iu1BoGjfTRp9xQDYWYCCSTjLQvTwN+RVzk9FsMUTzLo+?=
 =?us-ascii?Q?iOWAyADBnpUroy1eMuIkokN3QTyLdlbX9Ww2nVKC?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?s+XWBco2ZCziNh+Egm/5JqDi8sYngjMGX0oEdNEE56WU6sM0nlrlOKkQwHQg?=
 =?us-ascii?Q?ANazH4wMVKFk38VLTY0U/Jk3kzcR6C6aS4ol2xnYWmcS56Hs7IhYISJqZqeW?=
 =?us-ascii?Q?GF2icTCmyxRaops4NT/9gnAgO9mSj92QX5EknTu56svDPSKGdkmEgY8K11cP?=
 =?us-ascii?Q?7eIsTVtnO/s5LD9kuvkGur6gZmR2czDaK9a2jLM2teWNB24NaTWHBdoK5UDK?=
 =?us-ascii?Q?6oXbwR0oziVSjIEkVmMXF1uegzPxxgkdOueGfHGCmoGQrBGQ4b/XpUH5Gm38?=
 =?us-ascii?Q?BVynNBv4CanEZTnqfnNM+HPRZxODuLhi48aMaFndIErkqMonVYP1F6Y6e5fg?=
 =?us-ascii?Q?tpBfNqQUQbgb0uJg72Y1jFqNAKIt3YSjveqyt2vZ/4Q724pfuX2dkZPLg269?=
 =?us-ascii?Q?YDrLmdYF6t81GlCVxJJ3cAucRAY5D28FXwMhcvJyFJ2qcqxeNyNxj/LdHsNW?=
 =?us-ascii?Q?6joZ4KlCX/7dOpFk7H+x32Pgbxo4ab80K0tlNWdBHXpuHM/ejyuZIYy/hM1R?=
 =?us-ascii?Q?uYWS1185K2ZsJpEKemNi/BzvH7Lyuc6VlGlJTGnYenGrr2LM5nsQn6cJnrPu?=
 =?us-ascii?Q?c+iunoEja6qx9+yj9V19rCNOivnR60i/thbXKUPRV8OYnzyYcfnIK+x+zmcQ?=
 =?us-ascii?Q?jL3vj/Cj7b9F0bTEV9Hfn9diPiku9s8Z0KhXjXG8wKPQN+glW4O9+PQGJJ9R?=
 =?us-ascii?Q?s5cAaR65i+ljRg8XMjXB/RWbav69AB0v4hKX0JYZ/k6JYbPBI6At9l0LcIGX?=
 =?us-ascii?Q?/i1sSDjpg8iAdsbILOgkmGH6jXTsZSAwgSVWHWGMvbgefXBPghN/KZRf6Sck?=
 =?us-ascii?Q?XU+8CwAwr4PxIYlM5EPj69T+voFJN/GfiQZIJWr+ZiKLrxIdo3qshjwq+2bU?=
 =?us-ascii?Q?gqxLLVHyWOf71fSomFdChMBQpQSQUsMT+JTyzs/B368XGYBGyXuKtK/H501o?=
 =?us-ascii?Q?iv8ARQI1z239F0xxCIrHJCPtPtgKrFG5ryq9VEZOGMlAl4TuMe5OU05SBztg?=
 =?us-ascii?Q?6EO7HdjirR2FmxCLEv+1Tkoy4Y6AKKrhqKoimilYe0zfMEzXNLt6wg66w0Xg?=
 =?us-ascii?Q?Tz9WsU9aNyfUxD2xn53gee4vJPWFMmJo1Z+oGpxaLbw2fPbNn3/nWjuRGWL5?=
 =?us-ascii?Q?y+vPJWz2juGtbKdMHYPa0xiwmQmg4SGcnb6rOIM8NOnNhIKQ+EUjuZk=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4fb78a77-dc60-4392-309a-08dbdc15d95c
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4196.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2023 02:37:40.3193
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: x90hBugl9iB5fZLwFy60k0zc7RkXxLrtK2MHxDZba7kDOgpMT6zTq8J1e39EUAqiQ7nJVDEwyXpbidGaMmYHYw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR10MB4713
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.987,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-11-03_02,2023-11-02_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0 mlxscore=0
 spamscore=0 phishscore=0 adultscore=0 mlxlogscore=773 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2310240000
 definitions=main-2311030019
X-Proofpoint-GUID: jStd_mZ6EdNYszhb7rFSBFRblqIEi-bU
X-Proofpoint-ORIG-GUID: jStd_mZ6EdNYszhb7rFSBFRblqIEi-bU
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Thu, 02 Nov 2023 19:38:35 -0700 (PDT)

On 11/02/23 19:24, Mike Kravetz wrote:
> 
> In the specific case causing the null-ptr-deref, the resv_map pointer
> (vm_private_data) is NULL.

Hi Rik,

In commit bf4916922c60 hugetlbfs: extend hugetlb_vma_lock to private VMAs,
it correctly says:

    Extend the locking scheme used to protect shared hugetlb mappings from
    truncate vs page fault races, in order to protect private hugetlb mappings
    (with resv_map) against MADV_DONTNEED.

That qualification '(with resv_map)' caught my attention originally, and
I thought about it again while looking into this.  We now cover the common
cases, but there are still quite a few cases where resv_map is NULL for
private mappings.  In such cases, the race between MADV_DONTNEED and page
fault still exists.  Is that a concern?

With a bit more work we 'could' make sure every hugetlb vma has a lock
to participate in this scheme.

Any thhoughts?
-- 
Mike Kravetz