linux-kernel - Re: [PATCH RFC] mm: Fix kernel BUG when userfaultfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGsJ_4xDX5QFNemckan6FoeEoA8tU75HyX+viVdec2b0qLbPYg@mail.gmail.com>
Date: Thu, 20 Feb 2025 13:50:23 +1300
From: Barry Song <21cnbao@...il.com>
To: Peter Xu <peterx@...hat.com>
Cc: linux-mm@...ck.org, akpm@...ux-foundation.org, 
	linux-kernel@...r.kernel.org, zhengtangquan@...o.com, 
	Barry Song <v-songbaohua@...o.com>, Andrea Arcangeli <aarcange@...hat.com>, 
	Suren Baghdasaryan <surenb@...gle.com>, Al Viro <viro@...iv.linux.org.uk>, 
	Axel Rasmussen <axelrasmussen@...gle.com>, Brian Geffon <bgeffon@...gle.com>, 
	Christian Brauner <brauner@...nel.org>, David Hildenbrand <david@...hat.com>, Hugh Dickins <hughd@...gle.com>, 
	Jann Horn <jannh@...gle.com>, Kalesh Singh <kaleshsingh@...gle.com>, 
	"Liam R . Howlett" <Liam.Howlett@...cle.com>, Lokesh Gidra <lokeshgidra@...gle.com>, 
	Matthew Wilcox <willy@...radead.org>, Michal Hocko <mhocko@...e.com>, Mike Rapoport <rppt@...nel.org>, 
	Nicolas Geoffray <ngeoffray@...gle.com>, Ryan Roberts <ryan.roberts@....com>, 
	Shuah Khan <shuah@...nel.org>, ZhangPeng <zhangpeng362@...wei.com>
Subject: Re: [PATCH RFC] mm: Fix kernel BUG when userfaultfd_move encounters swapcache

On Thu, Feb 20, 2025 at 11:31 AM Peter Xu <peterx@...hat.com> wrote:
>
> On Thu, Feb 20, 2025 at 12:25:19AM +1300, Barry Song wrote:
> > @@ -1079,9 +1080,19 @@ static int move_swap_pte(struct mm_struct *mm,
> >                        pmd_t *dst_pmd, pmd_t dst_pmdval,
> >                        spinlock_t *dst_ptl, spinlock_t *src_ptl)
> >  {
> > +     struct folio *folio;
> > +     swp_entry_t entry;
> > +
> >       if (!pte_swp_exclusive(orig_src_pte))
> >               return -EBUSY;
> >
> > +     entry = pte_to_swp_entry(orig_src_pte);
> > +     folio = filemap_get_folio(swap_address_space(entry), swap_cache_index(entry));
>
> [Besides what's being discussed elsewhere..]
>
> swap_cache_get_folio() says:
>
>  * Caller must lock the swap device or hold a reference to keep it valid.
>
> Do we need get_swap_device() too here to avoid swapoff race?
>

Yep, thanks! Let me fix it in v2.

> > +     if (!IS_ERR(folio)) {
> > +             folio_put(folio);
> > +             return -EBUSY;
> > +     }
> > +
> >       double_pt_lock(dst_ptl, src_ptl);
> >
> >       if (!is_pte_pages_stable(dst_pte, src_pte, orig_dst_pte, orig_src_pte,
> > --
> > 2.39.3 (Apple Git-146)
> >
>
> --
> Peter Xu
>

Thanks
Barry