linux-kernel - Re: 4.5-rc1: mm/gup.c warning when writing to /proc/self/mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 30 Jan 2016 18:03:16 -0800 (PST)
From:	Hugh Dickins <hughd@...gle.com>
To:	"Kirill A. Shutemov" <kirill@...temov.name>
cc:	Dave Jones <davej@...emonkey.org.uk>, linux-mm@...ck.org,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	Hugh Dickins <hughd@...gle.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: 4.5-rc1: mm/gup.c warning when writing to /proc/self/mem

On Sat, 30 Jan 2016, Kirill A. Shutemov wrote:
> On Sat, Jan 30, 2016 at 12:58:31PM -0500, Dave Jones wrote:
> > Hit this overnight. Just started seeing this after I added "create mmap's
> > of fd's we open()'d" to trinity.
> 
> The WARN_ON_ONCE() came form Hugh's patch:
>  cda540ace6a1 ("mm: get_user_pages(write,force) refuse to COW in shared areas")
> 
> This warning is expected if you try to write via /proc/<pid>/mem into
> write-protected shared mapping without FMODE_WRITE on the underlying file.

Other way round: it happens only when you do have FMODE_WRITE on the file.
It was always a strange case.

> You're not supposed to do that and -EFAULT is right answer for an attempt.
> 
> The WARN_ON_ONCE() was added almost two years ago to catch other not
> expected users of get_user_pages(write=1,force=1). IIUC, none were found.
> 
> Probably we should consider removing the warning.

Yes, I agree: as a _ONCE, it doesn't do a whole lot of harm,
but we just don't need it any longer.  And it reminds me of
something else you pointed out to me back then...

> 
> > 
> > 	Dave
> > 
> > WARNING: CPU: 1 PID: 16733 at mm/gup.c:434 __get_user_pages+0x5f9/0x990()


[PATCH] mm: retire GUP WARN_ON_ONCE that outlived its usefulness

Trinity is now hitting the WARN_ON_ONCE we added in v3.15 commit
cda540ace6a1 ("mm: get_user_pages(write,force) refuse to COW in shared
areas").  The warning has served its purpose, nobody was harmed by that
change, so just remove the warning to generate less noise from Trinity.

Which reminds me of the comment I wrongly left behind with that commit
(but was spotted at the time by Kirill), which has since moved into a
separate function, and become even more obscure: delete it.

Reported-by: Dave Jones <davej@...emonkey.org.uk>
Suggested-by: Kirill A. Shutemov <kirill@...temov.name>
Signed-off-by: Hugh Dickins <hughd@...gle.com>
---

 mm/gup.c    |    4 +---
 mm/memory.c |    5 -----
 2 files changed, 1 insertion(+), 8 deletions(-)

--- 4.5-rc1/mm/gup.c	2016-01-24 14:54:58.031544001 -0800
+++ linux/mm/gup.c	2016-01-30 17:14:21.443281994 -0800
@@ -430,10 +430,8 @@ static int check_vma_flags(struct vm_are
 			 * Anon pages in shared mappings are surprising: now
 			 * just reject it.
 			 */
-			if (!is_cow_mapping(vm_flags)) {
-				WARN_ON_ONCE(vm_flags & VM_MAYWRITE);
+			if (!is_cow_mapping(vm_flags))
 				return -EFAULT;
-			}
 		}
 	} else if (!(vm_flags & VM_READ)) {
 		if (!(gup_flags & FOLL_FORCE))
--- 4.5-rc1/mm/memory.c	2016-01-24 14:54:58.051544131 -0800
+++ linux/mm/memory.c	2016-01-30 17:14:21.443281994 -0800
@@ -2232,11 +2232,6 @@ static int wp_page_shared(struct mm_stru
 
 	page_cache_get(old_page);
 
-	/*
-	 * Only catch write-faults on shared writable pages,
-	 * read-only shared pages can get COWed by
-	 * get_user_pages(.write=1, .force=1).
-	 */
 	if (vma->vm_ops && vma->vm_ops->page_mkwrite) {
 		int tmp;