| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <171354c3-c276-48c8-9a80-795f4aa7a471@nvidia.com>
Date: Tue, 19 Nov 2024 19:28:51 -0800
From: John Hubbard <jhubbard@...dia.com>
To: David Hildenbrand <david@...hat.com>, Andrew Morton
<akpm@...ux-foundation.org>
CC: LKML <linux-kernel@...r.kernel.org>, <linux-mm@...ck.org>, Oscar Salvador
<osalvador@...e.de>, Vivek Kasireddy <vivek.kasireddy@...el.com>, Dave Airlie
<airlied@...hat.com>, Gerd Hoffmann <kraxel@...hat.com>, Matthew Wilcox
<willy@...radead.org>, Christoph Hellwig <hch@...radead.org>, Jason Gunthorpe
<jgg@...dia.com>, Peter Xu <peterx@...hat.com>, Arnd Bergmann
<arnd@...db.de>, Daniel Vetter <daniel.vetter@...ll.ch>, Dongwon Kim
<dongwon.kim@...el.com>, Hugh Dickins <hughd@...gle.com>, Junxiao Chang
<junxiao.chang@...el.com>, <stable@...r.kernel.org>
Subject: Re: [PATCH] mm/gup: handle NULL pages in unpin_user_pages()
On 11/19/24 6:33 AM, David Hildenbrand wrote:
> On 19.11.24 05:49, John Hubbard wrote:
>> The recent addition of "pofs" (pages or folios) handling to gup has a
>> flaw: it assumes that unpin_user_pages() handles NULL pages in the
>> pages** array. That's not the case, as I discovered when I ran on a new
>> configuration on my test machine.
>>
>> Fix this by skipping NULL pages in unpin_user_pages(), just like
>> unpin_folios() already does.
>>
>> Details: when booting on x86 with "numa=fake=2 movablecore=4G" on Linux
>> 6.12, and running this:
>>
>> tools/testing/selftests/mm/gup_longterm
>>
>> ...I get the following crash:
>>
>> BUG: kernel NULL pointer dereference, address: 0000000000000008
>> RIP: 0010:sanity_check_pinned_pages+0x3a/0x2d0
>> ...
>> Call Trace:
>> <TASK>
>> ? __die_body+0x66/0xb0
>> ? page_fault_oops+0x30c/0x3b0
>> ? do_user_addr_fault+0x6c3/0x720
>> ? irqentry_enter+0x34/0x60
>> ? exc_page_fault+0x68/0x100
>> ? asm_exc_page_fault+0x22/0x30
>> ? sanity_check_pinned_pages+0x3a/0x2d0
>> unpin_user_pages+0x24/0xe0
>> check_and_migrate_movable_pages_or_folios+0x455/0x4b0
>> __gup_longterm_locked+0x3bf/0x820
>> ? mmap_read_lock_killable+0x12/0x50
>> ? __pfx_mmap_read_lock_killable+0x10/0x10
>> pin_user_pages+0x66/0xa0
>> gup_test_ioctl+0x358/0xb20
>> __se_sys_ioctl+0x6b/0xc0
>> do_syscall_64+0x7b/0x150
>> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>
>> Fixes: 94efde1d1539 ("mm/gup: avoid an unnecessary allocation call for FOLL_LONGTERM cases")
>> Cc: David Hildenbrand <david@...hat.com>
>> Cc: Oscar Salvador <osalvador@...e.de>
>> Cc: Vivek Kasireddy <vivek.kasireddy@...el.com>
>> Cc: Dave Airlie <airlied@...hat.com>
>> Cc: Gerd Hoffmann <kraxel@...hat.com>
>> Cc: Matthew Wilcox <willy@...radead.org>
>> Cc: Christoph Hellwig <hch@...radead.org>
>> Cc: Jason Gunthorpe <jgg@...dia.com>
>> Cc: Peter Xu <peterx@...hat.com>
>> Cc: Arnd Bergmann <arnd@...db.de>
>> Cc: Daniel Vetter <daniel.vetter@...ll.ch>
>> Cc: Dongwon Kim <dongwon.kim@...el.com>
>> Cc: Hugh Dickins <hughd@...gle.com>
>> Cc: Junxiao Chang <junxiao.chang@...el.com>
>> Cc: <stable@...r.kernel.org>
>> Signed-off-by: John Hubbard <jhubbard@...dia.com>
>> ---
>>
>> Hi,
>>
>> I got a nasty shock when I tried out a new test machine setup last
>> night--I wish I'd noticed the problem earlier! But anyway, this should
>> make it all better...
>>
>> I've asked Greg K-H to hold off on including commit 94efde1d1539
>> ("mm/gup: avoid an unnecessary allocation call for FOLL_LONGTERM cases")
>> in linux-stable (6.11.y), but if this fix-to-the-fix looks good, then
>> maybe both fixes can ultimately end up in stable.
>>
>
> Ouch!
>
>> thanks,
>> John Hubbard
>>
>> mm/gup.c | 17 +++++++++++++++--
>> 1 file changed, 15 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/gup.c b/mm/gup.c
>> index ad0c8922dac3..6e417502728a 100644
>> --- a/mm/gup.c
>> +++ b/mm/gup.c
>> @@ -52,7 +52,12 @@ static inline void sanity_check_pinned_pages(struct page **pages,
>> */
>> for (; npages; npages--, pages++) {
>> struct page *page = *pages;
>> - struct folio *folio = page_folio(page);
>> + struct folio *folio;
>> +
>> + if (!page)
>> + continue;
>> +
>> + folio = page_folio(page);
>> if (is_zero_page(page) ||
>> !folio_test_anon(folio))
>> @@ -248,9 +253,14 @@ static inline struct folio *gup_folio_range_next(struct page *start,
>> static inline struct folio *gup_folio_next(struct page **list,
>> unsigned long npages, unsigned long i, unsigned int *ntails)
>> {
>> - struct folio *folio = page_folio(list[i]);
>> + struct folio *folio;
>> unsigned int nr;
>> + if (!list[i])
>> + return NULL;
>> +
>
> I don't particularly enjoy returning NULL here, if we don't teach the other users of that function about that possibility. There are two other users.
>
> Also: we are not setting "ntails" to 1. I think the callers uses that as "nr" to advance npages. So the caller has to make sure to set "nr = 1" in case it sees "NULL".
>
> Alternatively ...
>
>> + folio = page_folio(list[i]);
>> +
>> for (nr = i + 1; nr < npages; nr++) {
>> if (page_folio(list[nr]) != folio)
>> break;
>> @@ -410,6 +420,9 @@ void unpin_user_pages(struct page **pages, unsigned long npages)
>> sanity_check_pinned_pages(pages, npages);
>> for (i = 0; i < npages; i += nr) {
>
> ... handle it here
>
> if (!pages[i]) {
> nr = 1;
> continue;
> }
>
> No strong opinion. But I think we should either update all callers to deal with returning NULL from this function, and set "nr = 1".
>
Yes, that makes sense. I'll send a v2 shortly with one or the other
approach implemented. I appreciate the review feedback as always!
thanks,
--
John Hubbard
Powered by blists - more mailing lists