linux-kernel - Re: [PATCH] mm/userfaultfd: fix missing PTE unmap for non-migration entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aG06QBVeBJgluSqP@lappy>
Date: Tue, 8 Jul 2025 11:33:20 -0400
From: Sasha Levin <sashal@...nel.org>
To: David Hildenbrand <david@...hat.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>, peterx@...hat.com,
	aarcange@...hat.com, surenb@...gle.com, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] mm/userfaultfd: fix missing PTE unmap for non-migration
 entries

On Tue, Jul 08, 2025 at 05:10:44PM +0200, David Hildenbrand wrote:
>On 01.07.25 02:57, Andrew Morton wrote:
>>On Sun, 29 Jun 2025 23:19:58 -0400 Sasha Levin <sashal@...nel.org> wrote:
>>
>>>When handling non-swap entries in move_pages_pte(), the error handling
>>>for entries that are NOT migration entries fails to unmap the page table
>>>entries before jumping to the error handling label.
>>>
>>>This results in a kmap/kunmap imbalance which on CONFIG_HIGHPTE systems
>>>triggers a WARNING in kunmap_local_indexed() because the kmap stack is
>>>corrupted.
>>>
>>>Example call trace on ARM32 (CONFIG_HIGHPTE enabled):
>>>   WARNING: CPU: 1 PID: 633 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c
>>>   Call trace:
>>>     kunmap_local_indexed from move_pages+0x964/0x19f4
>>>     move_pages from userfaultfd_ioctl+0x129c/0x2144
>>>     userfaultfd_ioctl from sys_ioctl+0x558/0xd24
>>>
>>>The issue was introduced with the UFFDIO_MOVE feature but became more
>>>frequent with the addition of guard pages (commit 7c53dfbdb024 ("mm: add
>>>PTE_MARKER_GUARD PTE marker")) which made the non-migration entry code
>>>path more commonly executed during userfaultfd operations.
>>>
>>>Fix this by ensuring PTEs are properly unmapped in all non-swap entry
>>>paths before jumping to the error handling label, not just for migration
>>>entries.
>>
>>I don't get it.
>>
>>>--- a/mm/userfaultfd.c
>>>+++ b/mm/userfaultfd.c
>>>@@ -1384,14 +1384,15 @@ static int move_pages_pte(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd,
>>>  		entry = pte_to_swp_entry(orig_src_pte);
>>>  		if (non_swap_entry(entry)) {
>>>+			pte_unmap(src_pte);
>>>+			pte_unmap(dst_pte);
>>>+			src_pte = dst_pte = NULL;
>>>  			if (is_migration_entry(entry)) {
>>>-				pte_unmap(src_pte);
>>>-				pte_unmap(dst_pte);
>>>-				src_pte = dst_pte = NULL;
>>>  				migration_entry_wait(mm, src_pmd, src_addr);
>>>  				err = -EAGAIN;
>>>-			} else
>>>+			} else {
>>>  				err = -EFAULT;
>>>+			}
>>>  			goto out;
>>
>>where we have
>>
>>out:
>>	...
>>	if (dst_pte)
>>		pte_unmap(dst_pte);
>>	if (src_pte)
>>		pte_unmap(src_pte);
>
>AI slop?

Nah, this one is sadly all me :(

I was trying to resolve some of the issues found with linus-next on
LKFT, and misunderstood the code. Funny enough, I thought that the
change above "fixed" it by making the warnings go away, but clearly is
the wrong thing to do so I went back to the drawing table...

If you're curious, here's the issue: https://qa-reports.linaro.org/lkft/sashal-linus-next/build/v6.13-rc7-43418-g558c6dd4d863/testrun/29030370/suite/log-parser-test/test/exception-warning-cpu-pid-at-mmhighmem-kunmap_local_indexed/details/

-- 
Thanks,
Sasha