diff mbox series

[14/31] fs/userfaultfd: retry if pte_offset_map() fails

Message ID 424274a4-7c13-e14-b380-428fc69a45c5@google.com
State New
Headers
Series mm: allow pte_offset_map[_lock]() to fail |

Commit Message

Hugh Dickins May 22, 2023, 5:06 a.m. UTC 
  Instead of worrying whether the pmd is stable, userfaultfd_must_wait()
call pte_offset_map() as before, but go back to try again if that fails.

Risk of endless loop?  It already broke out if pmd_none(), !pmd_present()
or pmd_trans_huge(), and pte_offset_map() would have cleared pmd_bad():
which leaves pmd_devmap().  Presumably pmd_devmap() is inappropriate in
a vma subject to userfaultfd (it would have been mistreated before),
but add a check just to avoid all possibility of endless loop there.

Signed-off-by: Hugh Dickins <hughd@google.com>
---
 fs/userfaultfd.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

Comments

Peter Xu May 24, 2023, 10:31 p.m. UTC | #1 
On Sun, May 21, 2023 at 10:06:32PM -0700, Hugh Dickins wrote:
> Instead of worrying whether the pmd is stable, userfaultfd_must_wait()
> call pte_offset_map() as before, but go back to try again if that fails.
> 
> Risk of endless loop?  It already broke out if pmd_none(), !pmd_present()
> or pmd_trans_huge(), and pte_offset_map() would have cleared pmd_bad():
> which leaves pmd_devmap().  Presumably pmd_devmap() is inappropriate in
> a vma subject to userfaultfd (it would have been mistreated before),
> but add a check just to avoid all possibility of endless loop there.

Agreed, afaiu that's for either PFNMAP or MIXEDMAP vmas only.  Maybe we can
use a WARN_ON_ONCE() for that to be clear, but no strong opinions.

> 
> Signed-off-by: Hugh Dickins <hughd@google.com>

Acked-by: Peter Xu <peterx@redhat.com>
diff mbox series

Patch

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index f7a0817b1ec0..ca83423f8d54 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -349,12 +349,13 @@  static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
 	if (!pud_present(*pud))
 		goto out;
 	pmd = pmd_offset(pud, address);
+again:
 	_pmd = pmdp_get_lockless(pmd);
 	if (pmd_none(_pmd))
 		goto out;
 
 	ret = false;
-	if (!pmd_present(_pmd))
+	if (!pmd_present(_pmd) || pmd_devmap(_pmd))
 		goto out;
 
 	if (pmd_trans_huge(_pmd)) {
@@ -363,11 +364,11 @@  static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
 		goto out;
 	}
 
-	/*
-	 * the pmd is stable (as in !pmd_trans_unstable) so we can re-read it
-	 * and use the standard pte_offset_map() instead of parsing _pmd.
-	 */
 	pte = pte_offset_map(pmd, address);
+	if (!pte) {
+		ret = true;
+		goto again;
+	}
 	/*
 	 * Lockless access: we're in a wait_event so it's ok if it
 	 * changes under us.  PTE markers should be handled the same as none