linux-kernel - Re: [PATCH 1/1] userfaultfd: fix move_pages_pte() splitting folio under RCU read lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJuCfpF8h4aPAvFQv4NjX=DRWTZ1P5DcO16DfT-Sot1cGucjJQ@mail.gmail.com>
Date: Tue, 2 Jan 2024 08:58:33 -0800
From: Suren Baghdasaryan <surenb@...gle.com>
To: Peter Xu <peterx@...hat.com>
Cc: akpm@...ux-foundation.org, viro@...iv.linux.org.uk, brauner@...nel.org, 
	shuah@...nel.org, aarcange@...hat.com, lokeshgidra@...gle.com, 
	david@...hat.com, ryan.roberts@....com, hughd@...gle.com, mhocko@...e.com, 
	axelrasmussen@...gle.com, rppt@...nel.org, willy@...radead.org, 
	Liam.Howlett@...cle.com, jannh@...gle.com, zhangpeng362@...wei.com, 
	bgeffon@...gle.com, kaleshsingh@...gle.com, ngeoffray@...gle.com, 
	jdduke@...gle.com, linux-mm@...ck.org, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org, 
	kernel-team@...roid.com
Subject: Re: [PATCH 1/1] userfaultfd: fix move_pages_pte() splitting folio
 under RCU read lock

On Tue, Jan 2, 2024 at 1:00 AM Peter Xu <peterx@...hat.com> wrote:
>
> On Fri, Dec 29, 2023 at 06:56:07PM -0800, Suren Baghdasaryan wrote:
> > @@ -1078,9 +1078,14 @@ static int move_pages_pte(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd,
> >
> >               /* at this point we have src_folio locked */
> >               if (folio_test_large(src_folio)) {
> > +                     /* split_folio() can block */
> > +                     pte_unmap(&orig_src_pte);
> > +                     pte_unmap(&orig_dst_pte);
> > +                     src_pte = dst_pte = NULL;
> >                       err = split_folio(src_folio);
> >                       if (err)
> >                               goto out;
> > +                     goto retry;
> >               }
>
> Do we also need to clear src_folio and src_folio_pte?  If the folio is a
> thp, I think it means it's pte mapped here. Then after the split we may
> want to fetch the small folio after the split, not the head one?

I think we need to re-fetch the src_folio only if the src_addr falls
into a non-head page. Looking at the __split_huge_page(), the head
page is skipped in the last loop, so I think it should stay valid.
That said, maybe it's just an implementation detail of the
__split_huge_page() and I should not rely on that and refetch anyway?

>
> --
> Peter Xu
>