linux-kernel - Re: [PATCH] mm/mremap: Fix move_normal_pmd/retract_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1c114925-9206-42b1-b24b-bb123853a359@bytedance.com>
Date: Tue, 8 Oct 2024 11:53:23 +0800
From: Qi Zheng <zhengqi.arch@...edance.com>
To: Jann Horn <jannh@...gle.com>
Cc: akpm@...ux-foundation.org, david@...hat.com, linux-mm@...ck.org,
 willy@...radead.org, hughd@...gle.com, lorenzo.stoakes@...cle.com,
 joel@...lfernandes.org, linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] mm/mremap: Fix move_normal_pmd/retract_page_tables race

Hi Jann,

On 2024/10/8 05:42, Jann Horn wrote:

[...]

> 
> diff --git a/mm/mremap.c b/mm/mremap.c
> index 24712f8dbb6b..dda09e957a5d 100644
> --- a/mm/mremap.c
> +++ b/mm/mremap.c
> @@ -238,6 +238,7 @@ static bool move_normal_pmd(struct vm_area_struct *vma, unsigned long old_addr,
>   {
>   	spinlock_t *old_ptl, *new_ptl;
>   	struct mm_struct *mm = vma->vm_mm;
> +	bool res = false;
>   	pmd_t pmd;
>   
>   	if (!arch_supports_page_table_move())
> @@ -277,19 +278,25 @@ static bool move_normal_pmd(struct vm_area_struct *vma, unsigned long old_addr,
>   	if (new_ptl != old_ptl)
>   		spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
>   
> -	/* Clear the pmd */
>   	pmd = *old_pmd;
> +
> +	/* Racing with collapse? */
> +	if (unlikely(!pmd_present(pmd) || pmd_leaf(pmd)))

Since we already hold the exclusive mmap lock, after a racing
with collapse occurs, the pmd entry cannot be refilled with
new content by page fault. So maybe we only need to recheck
pmd_none(pmd) here?

Thanks,
Qi

> +		goto out_unlock;
> +	/* Clear the pmd */
>   	pmd_clear(old_pmd);
> +	res = true;
>   
>   	VM_BUG_ON(!pmd_none(*new_pmd));
>   
>   	pmd_populate(mm, new_pmd, pmd_pgtable(pmd));
>   	flush_tlb_range(vma, old_addr, old_addr + PMD_SIZE);
> +out_unlock:
>   	if (new_ptl != old_ptl)
>   		spin_unlock(new_ptl);
>   	spin_unlock(old_ptl);
>   
> -	return true;
> +	return res;
>   }
>   #else
>   static inline bool move_normal_pmd(struct vm_area_struct *vma,
> 
> ---
> base-commit: 8cf0b93919e13d1e8d4466eb4080a4c4d9d66d7b
> change-id: 20241007-move_normal_pmd-vs-collapse-fix-2-387e9a68c7d6