linux-kernel - Re: [PATCH RFC] mm: Fix kernel BUG when userfaultfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGsJ_4xTXqdFdOuGKEw9MffQYPHasBVQ8aumL_kwGbCSvqJ9VQ@mail.gmail.com>
Date: Thu, 20 Feb 2025 10:05:29 +1300
From: Barry Song <21cnbao@...il.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: Suren Baghdasaryan <surenb@...gle.com>, Lokesh Gidra <lokeshgidra@...gle.com>, linux-mm@...ck.org, 
	akpm@...ux-foundation.org, linux-kernel@...r.kernel.org, 
	zhengtangquan@...o.com, Barry Song <v-songbaohua@...o.com>, 
	Andrea Arcangeli <aarcange@...hat.com>, Al Viro <viro@...iv.linux.org.uk>, 
	Axel Rasmussen <axelrasmussen@...gle.com>, Brian Geffon <bgeffon@...gle.com>, 
	Christian Brauner <brauner@...nel.org>, David Hildenbrand <david@...hat.com>, Hugh Dickins <hughd@...gle.com>, 
	Jann Horn <jannh@...gle.com>, Kalesh Singh <kaleshsingh@...gle.com>, 
	"Liam R . Howlett" <Liam.Howlett@...cle.com>, Michal Hocko <mhocko@...e.com>, 
	Mike Rapoport <rppt@...nel.org>, Nicolas Geoffray <ngeoffray@...gle.com>, Peter Xu <peterx@...hat.com>, 
	Ryan Roberts <ryan.roberts@....com>, Shuah Khan <shuah@...nel.org>, 
	ZhangPeng <zhangpeng362@...wei.com>, Yu Zhao <yuzhao@...gle.com>
Subject: Re: [PATCH RFC] mm: Fix kernel BUG when userfaultfd_move encounters swapcache

On Thu, Feb 20, 2025 at 9:57 AM Matthew Wilcox <willy@...radead.org> wrote:
>
> On Thu, Feb 20, 2025 at 09:37:50AM +1300, Barry Song wrote:
> > > How complex would that be? Is it a matter of adding
> > > folio_maybe_dma_pinned() checks, doing folio_move_anon_rmap() and
> > > folio->index = linear_page_index like in move_present_pte() or
> > > something more?
> >
> > My main concern is still with large folios that require a split_folio()
> > during move_pages(), as the entire folio shares the same index and
> > anon_vma. However, userfaultfd_move() moves pages individually,
> > making a split necessary.
> >
> > However, in split_huge_page_to_list_to_order(), there is a:
> >
> >         if (folio_test_writeback(folio))
> >                 return -EBUSY;
> >
> > This is likely true for swapcache, right?
>
> I don't see why?  When they get moved to the swap cache, yes, they're
> immediately written back, but after being swapped back in, they stay in
> the swap cache, so they don't have to be moved back to the swap cache.
> Right?

I don’t quite understand your question. The issue we’re discussing is
that the folio is in swapcache. Right now, we’re encountering a kernel
crash because we haven’t fixed the folio’s index. If we want to address
that, we need to perform a split_folio() for mTHP. Since we’re already
dealing with swapcache, we’re likely in a situation where we’re doing
writeback (pageout), considering Android uses sync zram. So, if
swapcache is true, writeback is probably true as well.

The race occurs after we call add_to_swap(), try_to_unmap() and
before we complete the writeback - page. (Swapcache will be cleared
for the sync device once the writeback is finished.)

Thanks
Barry