linux-kernel - Re: [PATCH] mm: Fix PTE_AF handling in fault path on architectures with HW AF support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c3d96f76-abd2-48d6-a20b-86cdfb91f122@redhat.com>
Date: Wed, 10 Jul 2024 06:07:13 +0200
From: David Hildenbrand <david@...hat.com>
To: Ram Tummala <rtummala@...dia.com>, akpm@...ux-foundation.org,
 fengwei.yin@...el.com
Cc: willy@...radead.org, linux-mm@...ck.org, linux-kernel@...r.kernel.org,
 apopple@...dia.com, stable@...r.kernel.org
Subject: Re: [PATCH] mm: Fix PTE_AF handling in fault path on architectures
 with HW AF support

On 10.07.24 02:09, Ram Tummala wrote:
> Commit 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()")
> replaced do_set_pte() with set_pte_range() and that introduced a regression
> in the following faulting path of non-anonymous vmas on CPUs with HW AF
> support.
> 
> handle_pte_fault()
>    do_pte_missing()
>      do_fault()
>        do_read_fault() || do_cow_fault() || do_shared_fault()
>          finish_fault()
>            set_pte_range()
> 
> The polarity of prefault calculation is incorrect. This leads to prefault
> being incorrectly set for the faulting address. The following if check will
> incorrectly clear the PTE_AF bit instead of setting it and the access will
> fault again on the same address due to the missing PTE_AF bit.
> 
>      if (prefault && arch_wants_old_prefaulted_pte())
>          entry = pte_mkold(entry);
> 
> On a subsequent fault on the same address, the faulting path will see a non
> NULL vmf->pte and instead of reaching the do_pte_missing() path, PTE_AF
> will be correctly set in handle_pte_fault() itself.
> 
> Due to this bug, performance degradation in the fault handling path will be
> observed due to unnecessary double faulting.
> 
> Cc: stable@...r.kernel.org
> Fixes: 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()")
> Signed-off-by: Ram Tummala <rtummala@...dia.com>
> ---

Acked-by: David Hildenbrand <david@...hat.com>

-- 
Cheers,

David / dhildenb