linux-kernel - Re: [PATCH v2 23/26] userfaultfd: wp: don't wake up when doing write protect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190225211528.GF10454@rapoport-lnx>
Date:   Mon, 25 Feb 2019 23:15:28 +0200
From:   Mike Rapoport <rppt@...ux.ibm.com>
To:     Peter Xu <peterx@...hat.com>
Cc:     Jerome Glisse <jglisse@...hat.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, David Hildenbrand <david@...hat.com>,
        Hugh Dickins <hughd@...gle.com>,
        Maya Gokhale <gokhale2@...l.gov>,
        Pavel Emelyanov <xemul@...tuozzo.com>,
        Johannes Weiner <hannes@...xchg.org>,
        Martin Cracauer <cracauer@...s.org>, Shaohua Li <shli@...com>,
        Marty McFadden <mcfadden8@...l.gov>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Denis Plotnikov <dplotnikov@...tuozzo.com>,
        Mike Rapoport <rppt@...ux.vnet.ibm.com>,
        Mel Gorman <mgorman@...e.de>,
        "Kirill A . Shutemov" <kirill@...temov.name>,
        "Dr . David Alan Gilbert" <dgilbert@...hat.com>
Subject: Re: [PATCH v2 23/26] userfaultfd: wp: don't wake up when doing write
 protect

On Mon, Feb 25, 2019 at 04:58:46PM +0800, Peter Xu wrote:
> On Thu, Feb 21, 2019 at 01:36:54PM -0500, Jerome Glisse wrote:
> > On Tue, Feb 12, 2019 at 10:56:29AM +0800, Peter Xu wrote:
> > > It does not make sense to try to wake up any waiting thread when we're
> > > write-protecting a memory region.  Only wake up when resolving a write
> > > protected page fault.
> > > 
> > > Signed-off-by: Peter Xu <peterx@...hat.com>
> > 
> > I am bit confuse here, see below.
> > 
> > > ---
> > >  fs/userfaultfd.c | 13 ++++++++-----
> > >  1 file changed, 8 insertions(+), 5 deletions(-)
> > > 
> > > diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
> > > index 81962d62520c..f1f61a0278c2 100644
> > > --- a/fs/userfaultfd.c
> > > +++ b/fs/userfaultfd.c
> > > @@ -1771,6 +1771,7 @@ static int userfaultfd_writeprotect(struct userfaultfd_ctx *ctx,
> > >  	struct uffdio_writeprotect uffdio_wp;
> > >  	struct uffdio_writeprotect __user *user_uffdio_wp;
> > >  	struct userfaultfd_wake_range range;
> > > +	bool mode_wp, mode_dontwake;
> > >  
> > >  	if (READ_ONCE(ctx->mmap_changing))
> > >  		return -EAGAIN;
> > > @@ -1789,18 +1790,20 @@ static int userfaultfd_writeprotect(struct userfaultfd_ctx *ctx,
> > >  	if (uffdio_wp.mode & ~(UFFDIO_WRITEPROTECT_MODE_DONTWAKE |
> > >  			       UFFDIO_WRITEPROTECT_MODE_WP))
> > >  		return -EINVAL;
> > > -	if ((uffdio_wp.mode & UFFDIO_WRITEPROTECT_MODE_WP) &&
> > > -	     (uffdio_wp.mode & UFFDIO_WRITEPROTECT_MODE_DONTWAKE))
> 
> [1]
> 
> > > +
> > > +	mode_wp = uffdio_wp.mode & UFFDIO_WRITEPROTECT_MODE_WP;
> > > +	mode_dontwake = uffdio_wp.mode & UFFDIO_WRITEPROTECT_MODE_DONTWAKE;
> > > +
> > > +	if (mode_wp && mode_dontwake)
> 
> [2]
> 
> > >  		return -EINVAL;
> > 
> > I am confuse by the logic here. DONTWAKE means do not wake any waiting
> > thread right ? So if the patch header it seems to me the logic should
> > be:
> >     if (mode_wp && !mode_dontwake)
> >         return -EINVAL;
> 
> This should be the most common case when we want to write protect a
> page (or a set of pages).  I'll explain more details below...
> 
> > 
> > At very least this part does seems to mean the opposite of what the
> > commit message says.
> 
> Let me paste the matrix to be clear on these flags:
> 
>   |------+-------------------------+------------------------------|
>   |      | dontwake=0              | dontwake=1                   |
>   |------+-------------------------+------------------------------|
>   | wp=0 | (a) resolve pf, do wake | (b) resolve pf only, no wake |
>   | wp=1 | (c) wp page range       | (d) invalid                  |
>   |------+-------------------------+------------------------------|
> 
> Above check at [1] was checking against case (d) in the matrix.  It is
> indeed an invalid condition because when we want to write protect a
> page we should not try to wake up any thread, so the donewake
> parameter is actually useless (we'll always do that).  And above [2]
> is simply rewritting [1] with the new variables.

I think (c) is "wp range and wake the thread", and (d) is "wp and DONT
wake".

 
> > 
> > >  
> > >  	ret = mwriteprotect_range(ctx->mm, uffdio_wp.range.start,
> > > -				  uffdio_wp.range.len, uffdio_wp.mode &
> > > -				  UFFDIO_WRITEPROTECT_MODE_WP,
> > > +				  uffdio_wp.range.len, mode_wp,
> > >  				  &ctx->mmap_changing);
> > >  	if (ret)
> > >  		return ret;
> > >  
> > > -	if (!(uffdio_wp.mode & UFFDIO_WRITEPROTECT_MODE_DONTWAKE)) {
> > > +	if (!mode_wp && !mode_dontwake) {
> > 
> > This part match the commit message :)
> 
> Here is what the patch really want to change: before this patch we'll
> even call wake_userfault() below for case (c) while it doesn't really
> make too much sense IMHO.  After this patch we'll only do the wakeup
> for (a,b).

Waking up the thread after the last region is write-protected would make
sense. Not much savings for lots of ranges, though.
 
> > 
> > >  		range.start = uffdio_wp.range.start;
> > >  		range.len = uffdio_wp.range.len;
> > >  		wake_userfault(ctx, &range);
> 
> Thanks,
> 
> -- 
> Peter Xu
> 

-- 
Sincerely yours,
Mike.