linux-kernel - Re: [PATCH v6 03/23] mm: Check against orig_pte for finish

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 16 Dec 2021 13:50:47 +0800
From:   Peter Xu <peterx@...hat.com>
To:     Alistair Popple <apopple@...dia.com>
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Axel Rasmussen <axelrasmussen@...gle.com>,
        Nadav Amit <nadav.amit@...il.com>,
        Mike Rapoport <rppt@...ux.vnet.ibm.com>,
        Hugh Dickins <hughd@...gle.com>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        "Kirill A . Shutemov" <kirill@...temov.name>,
        Jerome Glisse <jglisse@...hat.com>,
        Matthew Wilcox <willy@...radead.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        David Hildenbrand <david@...hat.com>,
        Andrea Arcangeli <aarcange@...hat.com>
Subject: Re: [PATCH v6 03/23] mm: Check against orig_pte for finish_fault()

On Thu, Dec 16, 2021 at 01:38:33PM +0800, Peter Xu wrote:
> On Thu, Dec 16, 2021 at 04:01:47PM +1100, Alistair Popple wrote:
> > On Monday, 15 November 2021 6:55:02 PM AEDT Peter Xu wrote:
> > > We used to check against none pte and in those cases orig_pte should always be
> > > none pte anyway.
> > 
> > Is that always true? From what I can see in handle_pte_fault() orig_pte only
> > gets initialised in the !pmd_none() case so might not be pte_none.
> 
> I believe it's true, otherwise I must have overlooked.
> 
> IMHO it's not "when we set orig_pte" that matters - note that finish_fault()
> (that this patch modifies) is only called for file-backed memories, and it's
> only called in do_fault() where the pte is not mapped at all.
> 
> DAX seems to call it too, but still DAX comes from do_fault() too, afaict.
> 
> The pte will not be mapped in two cases in handle_pte_fault():
> 
>   - When pmd_none
> 
>   - When !pmd_none, however if we find that pte_none==true, that's:
> 
>         if (pte_none(vmf->orig_pte)) {
>                 pte_unmap(vmf->pte);
>                 vmf->pte = NULL;
>         }
> 
> So when we're already in do_fault(), afaict, orig_pte must be pte_none().
> Another side note is that, IIUC pte_none() is a looser check than the
> pte_val()==0 and it should be arch dependent.

So one more thing I forgot to mention... Of course above is based on the fact
that orig_pte will be initialized to zero when creating vmf structure, and
that's done in __handle_mm_fault():

	struct vm_fault vmf = {
		.vma = vma,
		.address = address & PAGE_MASK,
		.flags = flags,
		.pgoff = linear_page_index(vma, address),
		.gfp_mask = __get_fault_gfp_mask(vma),
	};

I'm not sure whether I should explicitly set it to pte_val(0), in most C
programs we'll already assume it's a proper reset of orig_pte value in c99
initialization format, but if anyone thinks we should do that explicitly plus
some comments I can do that too.

> 
> Thanks,
> 
> > 
> > > This change prepares us to be able to call do_fault() on !none ptes.  For
> > > example, we should allow that to happen for pte marker so that we can restore
> > > information out of the pte markers.
> > > 
> > > Signed-off-by: Peter Xu <peterx@...hat.com>
> > > ---
> > >  mm/memory.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/mm/memory.c b/mm/memory.c
> > > index 04662b010005..d5966d9e24c3 100644
> > > --- a/mm/memory.c
> > > +++ b/mm/memory.c
> > > @@ -4052,7 +4052,7 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
> > >  				      vmf->address, &vmf->ptl);
> > >  	ret = 0;
> > >  	/* Re-check under ptl */
> > > -	if (likely(pte_none(*vmf->pte)))
> > > +	if (likely(pte_same(*vmf->pte, vmf->orig_pte)))
> > >  		do_set_pte(vmf, page, vmf->address);
> > >  	else
> > >  		ret = VM_FAULT_NOPAGE;
> > > 
> > 
> > 
> > 
> > 
> 
> -- 
> Peter Xu

-- 
Peter Xu