Received-SPF: pass (google.com: domain of linux-kernel+bounces-106795-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Precedence: bulk
MIME-Version: 1.0
References: <20240318230013.87543-1-21cnbao@gmail.com> <CAJD7tkYVJHsWoaEkTiTigJRzSNBrRSg3YVAL3Q5Q96cLSNJZrQ@mail.gmail.com>
In-Reply-To: <CAJD7tkYVJHsWoaEkTiTigJRzSNBrRSg3YVAL3Q5Q96cLSNJZrQ@mail.gmail.com>
From: Barry Song <21cnbao@gmail.com>
Date: Tue, 19 Mar 2024 12:12:12 +1300
Message-ID: <CAGsJ_4wqPuZc47h=QRPForrxinhG3cvoh4VupLyDRo_uhneC-g@mail.gmail.com>
Subject: Re: [PATCH] mm: zswap: fix kernel BUG in sg_init_one
To: Yosry Ahmed <yosryahmed@google.com>
Cc: hannes@cmpxchg.org, nphamcs@gmail.com, akpm@linux-foundation.org, 
	chrisl@kernel.org, v-songbaohua@oppo.com, linux-mm@kvack.org, 
	linux-kernel@vger.kernel.org, ira.weiny@intel.com, 
	syzbot+adbc983a1588b7805de3@syzkaller.appspotmail.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Mar 19, 2024 at 12:06=E2=80=AFPM Yosry Ahmed <yosryahmed@google.com=
> wrote:
>
> On Mon, Mar 18, 2024 at 4:00=E2=80=AFPM Barry Song <21cnbao@gmail.com> wr=
ote:
> >
> > From: Barry Song <v-songbaohua@oppo.com>
> >
> > sg_init_one() relies on linearly mapped low memory for the safe
> > utilization of virt_to_page(). Consequently, we have two choices:
> > either employ kmap_to_page() alongside sg_set_page(), or resort to
> > copying high memory contents to a temporary buffer residing in low
> > memory. However, considering the introduction of the WARN_ON_ONCE
> > in commit ef6e06b2ef870 ("highmem: fix kmap_to_page() for
> > kmap_local_page() addresses"), which specifically addresses high
> > memory concerns, it appears that memcpy remains the sole viable
> > option.
> >
> > Reported-and-tested-by: syzbot+adbc983a1588b7805de3@syzkaller.appspotma=
il.com
> > Closes: https://lore.kernel.org/all/000000000000bbb3d80613f243a6@google=
com/
> > Fixes: 270700dd06ca ("mm/zswap: remove the memcpy if acomp is not sleep=
able")
> > Signed-off-by: Barry Song <v-songbaohua@oppo.com>
> > ---
> >  mm/zswap.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/mm/zswap.c b/mm/zswap.c
> > index 9dec853647c8..17bf6d87b274 100644
> > --- a/mm/zswap.c
> > +++ b/mm/zswap.c
> > @@ -1080,7 +1080,8 @@ static void zswap_decompress(struct zswap_entry *=
entry, struct page *page)
> >         mutex_lock(&acomp_ctx->mutex);
> >
> >         src =3D zpool_map_handle(zpool, entry->handle, ZPOOL_MM_RO);
> > -       if (acomp_ctx->is_sleepable && !zpool_can_sleep_mapped(zpool)) =
{
> > +       if ((acomp_ctx->is_sleepable && !zpool_can_sleep_mapped(zpool))=
 ||
> > +           !virt_addr_valid(src)) {
>
>
> Would it be better to explicitly check is_kmap_addr() here? I am
> particularly worried about hiding a bug where the returned address
> from zpool_map_handle() is not a kmap address, but also not a valid
> linear mapping address.
>
> If we use is_kmap_addr() here, then the virt_addr_valid() check in
> sg_init_one() will catch any non-kmap non-linear mapping addresses.
> WDYT? Am I being paranoid? :)

we have a possibility that a userspace buffer or vmalloc address is given t=
o
sg_init_one, then it is non-kmap non-linear. but is it possible someday som=
e
people return a vmalloc/vmap address from zpool_map_handle() in the future?
then we still need !virt_addr_valid().

>
> Also, I think a comment would be nice to explain the cases where we
> need to use a temporary buffer since we have two different cases now.

that makes sense.

>
> >
> >                 memcpy(acomp_ctx->buffer, src, entry->length);
> >                 src =3D acomp_ctx->buffer;
> >                 zpool_unmap_handle(zpool, entry->handle);
> > @@ -1094,7 +1095,7 @@ static void zswap_decompress(struct zswap_entry *=
entry, struct page *page)
> >         BUG_ON(acomp_ctx->req->dlen !=3D PAGE_SIZE);
> >         mutex_unlock(&acomp_ctx->mutex);
> >
> > -       if (!acomp_ctx->is_sleepable || zpool_can_sleep_mapped(zpool))
> > +       if (src !=3D acomp_ctx->buffer)
> >                 zpool_unmap_handle(zpool, entry->handle);
> >  }
> >
> > --
> > 2.34.1
> >