[v7,2/3] mm/gup: disallow FOLL_LONGTERM GUP-nonfast writing to file-backed mappings
Message ID | f50f2b5794820a1f5dc597277a5f0a9a87d9d152.1683044162.git.lstoakes@gmail.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp756868vqo; Tue, 2 May 2023 09:49:38 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4qhKQG72IzgSIoU65KoIMWN70vg7YC3UHMq5BA6T0USUjTKUOsg9omTK1ixfaqstNqqR04 X-Received: by 2002:a05:6a00:2356:b0:640:defd:a6bd with SMTP id j22-20020a056a00235600b00640defda6bdmr22915529pfj.12.1683046177753; Tue, 02 May 2023 09:49:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683046177; cv=none; d=google.com; s=arc-20160816; b=0y5dbfb+ANlu+4TLQxRmkP/C1TDFi5AE2C2FQSwzuIhpdZGE7VPbbstEhbqkb0BxRx eEJU/576CLWx5jD+tMpm2KTHAIJDNYVCx6XgipC4yXd/NxAzrcrXA4QNzh/KeY5JYCVd xMA1bWpkWNdekM2TIriTfQEVFuYqnHTplBe6uQCX61X6rpHOiS5G2nhZ/GwvbmPECKrE XZRNJfNB/wmTfHV6DFVFGtT1r2SF5lO409P3O79yrOtDGnd/mXo0RQ/yscZZ0P97cHO5 EazG6XVoxeGQvn3C7vHFcOirus/aXu7mHPP4SQz9eJ/Xep8/DmjR1ZUzItd9lPjMgkt+ RMrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=hDxuvhlrwYGCtBwJIBLRhiGRbpzp5H+edOHA56egbkk=; b=aRye0D3UYnvJcTatCi+rZ8tAcG1TXQomNOSnBKuVU5IyLNSxThAp1FRel4CzRGces2 0svLeTRqKfq9SnkaYvmoWHdstirMGjgZWiQBhUXWiL34ssail+DyO7WJoW/BoSWQ/+O2 lbezpR33WDbFepqht3n79U3nqGjJZdIdtj9ycUIkyWEzn0y/cT811YwInujaK2cBjwKP 9H5fsOEwP0X/qnrXDyNgaE4OUCgTuINnK4lEyC3zKkiwXLmLWgymUAYPKb91JCtfItee KyFFdkpa+xYik4ImVz9KwZ3fsfVwteZ+4zCgQgo85/X0LemQ0WUhTrXGtQreUi4GdPYa KUVg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=IzG1Ue+s; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k4-20020aa79984000000b0063b8982c669si30478544pfh.317.2023.05.02.09.49.23; Tue, 02 May 2023 09:49:37 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=IzG1Ue+s; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234220AbjEBQea (ORCPT <rfc822;rbbytesnap@gmail.com> + 99 others); Tue, 2 May 2023 12:34:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233982AbjEBQeU (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Tue, 2 May 2023 12:34:20 -0400 Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com [IPv6:2a00:1450:4864:20::42e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 20E301BCD; Tue, 2 May 2023 09:34:17 -0700 (PDT) Received: by mail-wr1-x42e.google.com with SMTP id ffacd0b85a97d-2fa36231b1cso2558223f8f.2; Tue, 02 May 2023 09:34:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1683045255; x=1685637255; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hDxuvhlrwYGCtBwJIBLRhiGRbpzp5H+edOHA56egbkk=; b=IzG1Ue+sSjQWtDgF8bz1cO/9kEB4U3eS7wvUN/6uPiFcmH2vv0p05zz51RdT/E83Wn XQP93rJPRSGEFCCBeCbLVXitY9duUiLNsZBpeMytKwCqyjci89S5XDxh8M90J/hQDnzQ o25rVRVm2U142hmp8kO/5pvZGP9Xna1YVoCQEnY2Vd0m+39z5B55LjxK9+F1kqQnoD1P /9GV9jgDeJbIvZ6SINb2LlC1rtj1ZTv/EW8niyMtcoqE7W8ntWqIZ0bKole79HgABDsR ohN7aLpVRQqhatNalKmgDP71L16ymM+oJLSfAE6gwytQz7iNjYVNfYTkejTY81Whm9tn 0Vzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683045255; x=1685637255; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=hDxuvhlrwYGCtBwJIBLRhiGRbpzp5H+edOHA56egbkk=; b=WxZuyLB1edRYql7j3eOp9jDrC2bkVbn4Es0D72NEhYtGSliOfLYYu/Q8cH6vV7j+Kx BF0wVc2xpRue63yCYMxLLy7PgE0GJqNy5xFnAT4P2hog8kwBQke+qt4gVeiqdmBEI0io v7DkoLe71Ldz7hI9apfc1wIHSljYsxPE/8bXS3wkXfoM05fVGOsFiEzKqrZ7VbYDjX/h bn/zS/gKLbAniHIn89r315OeWNfBIP4Qkp07B63mw6cJbA2zp0rpc89AlT/wpLjI7nQV jeFZR7fo8mUeblhzP4ZY8byXqkQHvgkTXcOSnF51rGdX2Dphy24g1VtnoouECzlBKq/F RCCg== X-Gm-Message-State: AC+VfDwT110H/cFcdeu3zjQ8yjXfZOHgbtPwoSGGSTizmR1DfVwhTFiu Xnaxhf9af7R6vVtnAPh6LHM= X-Received: by 2002:a5d:4090:0:b0:2c5:3cd2:b8e with SMTP id o16-20020a5d4090000000b002c53cd20b8emr10899748wrp.1.1683045255467; Tue, 02 May 2023 09:34:15 -0700 (PDT) Received: from lucifer.home (host86-156-84-164.range86-156.btcentralplus.com. [86.156.84.164]) by smtp.googlemail.com with ESMTPSA id b10-20020a5d550a000000b0030639a86f9dsm1789919wrv.51.2023.05.02.09.34.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 May 2023 09:34:14 -0700 (PDT) From: Lorenzo Stoakes <lstoakes@gmail.com> To: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org> Cc: Jason Gunthorpe <jgg@ziepe.ca>, Jens Axboe <axboe@kernel.dk>, Matthew Wilcox <willy@infradead.org>, Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>, Leon Romanovsky <leon@kernel.org>, Christian Benvenuti <benve@cisco.com>, Nelson Escobar <neescoba@cisco.com>, Bernard Metzler <bmt@zurich.ibm.com>, Peter Zijlstra <peterz@infradead.org>, Ingo Molnar <mingo@redhat.com>, Arnaldo Carvalho de Melo <acme@kernel.org>, Mark Rutland <mark.rutland@arm.com>, Alexander Shishkin <alexander.shishkin@linux.intel.com>, Jiri Olsa <jolsa@kernel.org>, Namhyung Kim <namhyung@kernel.org>, Ian Rogers <irogers@google.com>, Adrian Hunter <adrian.hunter@intel.com>, Bjorn Topel <bjorn@kernel.org>, Magnus Karlsson <magnus.karlsson@intel.com>, Maciej Fijalkowski <maciej.fijalkowski@intel.com>, Jonathan Lemon <jonathan.lemon@gmail.com>, "David S . Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, Christian Brauner <brauner@kernel.org>, Richard Cochran <richardcochran@gmail.com>, Alexei Starovoitov <ast@kernel.org>, Daniel Borkmann <daniel@iogearbox.net>, Jesper Dangaard Brouer <hawk@kernel.org>, John Fastabend <john.fastabend@gmail.com>, linux-fsdevel@vger.kernel.org, linux-perf-users@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, Oleg Nesterov <oleg@redhat.com>, Jason Gunthorpe <jgg@nvidia.com>, John Hubbard <jhubbard@nvidia.com>, Jan Kara <jack@suse.cz>, "Kirill A . Shutemov" <kirill@shutemov.name>, Pavel Begunkov <asml.silence@gmail.com>, Mika Penttila <mpenttil@redhat.com>, David Hildenbrand <david@redhat.com>, Dave Chinner <david@fromorbit.com>, Theodore Ts'o <tytso@mit.edu>, Peter Xu <peterx@redhat.com>, Matthew Rosato <mjrosato@linux.ibm.com>, "Paul E . McKenney" <paulmck@kernel.org>, Christian Borntraeger <borntraeger@linux.ibm.com>, Lorenzo Stoakes <lstoakes@gmail.com> Subject: [PATCH v7 2/3] mm/gup: disallow FOLL_LONGTERM GUP-nonfast writing to file-backed mappings Date: Tue, 2 May 2023 17:34:04 +0100 Message-Id: <f50f2b5794820a1f5dc597277a5f0a9a87d9d152.1683044162.git.lstoakes@gmail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <cover.1683044162.git.lstoakes@gmail.com> References: <cover.1683044162.git.lstoakes@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1764801828883197019?= X-GMAIL-MSGID: =?utf-8?q?1764801828883197019?= |
Series |
mm/gup: disallow GUP writing to file-backed mappings by default
|
|
Commit Message
Lorenzo Stoakes
May 2, 2023, 4:34 p.m. UTC
Writing to file-backed mappings which require folio dirty tracking using GUP is a fundamentally broken operation, as kernel write access to GUP mappings do not adhere to the semantics expected by a file system. A GUP caller uses the direct mapping to access the folio, which does not cause write notify to trigger, nor does it enforce that the caller marks the folio dirty. The problem arises when, after an initial write to the folio, writeback results in the folio being cleaned and then the caller, via the GUP interface, writes to the folio again. As a result of the use of this secondary, direct, mapping to the folio no write notify will occur, and if the caller does mark the folio dirty, this will be done so unexpectedly. For example, consider the following scenario:- 1. A folio is written to via GUP which write-faults the memory, notifying the file system and dirtying the folio. 2. Later, writeback is triggered, resulting in the folio being cleaned and the PTE being marked read-only. 3. The GUP caller writes to the folio, as it is mapped read/write via the direct mapping. 4. The GUP caller, now done with the page, unpins it and sets it dirty (though it does not have to). This results in both data being written to a folio without writenotify, and the folio being dirtied unexpectedly (if the caller decides to do so). This issue was first reported by Jan Kara [1] in 2018, where the problem resulted in file system crashes. This is only relevant when the mappings are file-backed and the underlying file system requires folio dirty tracking. File systems which do not, such as shmem or hugetlb, are not at risk and therefore can be written to without issue. Unfortunately this limitation of GUP has been present for some time and requires future rework of the GUP API in order to provide correct write access to such mappings. However, for the time being we introduce this check to prevent the most egregious case of this occurring, use of the FOLL_LONGTERM pin. These mappings are considerably more likely to be written to after folios are cleaned and thus simply must not be permitted to do so. This patch changes only the slow-path GUP functions, a following patch adapts the GUP-fast path along similar lines. [1]:https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz/ Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com> Reviewed-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Mika Penttilä <mpenttil@redhat.com> Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> --- mm/gup.c | 43 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-)
Comments
On 02.05.23 18:34, Lorenzo Stoakes wrote: > Writing to file-backed mappings which require folio dirty tracking using > GUP is a fundamentally broken operation, as kernel write access to GUP > mappings do not adhere to the semantics expected by a file system. > > A GUP caller uses the direct mapping to access the folio, which does not > cause write notify to trigger, nor does it enforce that the caller marks > the folio dirty. > > The problem arises when, after an initial write to the folio, writeback > results in the folio being cleaned and then the caller, via the GUP > interface, writes to the folio again. > > As a result of the use of this secondary, direct, mapping to the folio no > write notify will occur, and if the caller does mark the folio dirty, this > will be done so unexpectedly. > > For example, consider the following scenario:- > > 1. A folio is written to via GUP which write-faults the memory, notifying > the file system and dirtying the folio. > 2. Later, writeback is triggered, resulting in the folio being cleaned and > the PTE being marked read-only. > 3. The GUP caller writes to the folio, as it is mapped read/write via the > direct mapping. > 4. The GUP caller, now done with the page, unpins it and sets it dirty > (though it does not have to). > > This results in both data being written to a folio without writenotify, and > the folio being dirtied unexpectedly (if the caller decides to do so). > > This issue was first reported by Jan Kara [1] in 2018, where the problem > resulted in file system crashes. > > This is only relevant when the mappings are file-backed and the underlying > file system requires folio dirty tracking. File systems which do not, such > as shmem or hugetlb, are not at risk and therefore can be written to > without issue. > > Unfortunately this limitation of GUP has been present for some time and > requires future rework of the GUP API in order to provide correct write > access to such mappings. > > However, for the time being we introduce this check to prevent the most > egregious case of this occurring, use of the FOLL_LONGTERM pin. > > These mappings are considerably more likely to be written to after > folios are cleaned and thus simply must not be permitted to do so. > > This patch changes only the slow-path GUP functions, a following patch > adapts the GUP-fast path along similar lines. > > [1]:https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz/ > > Suggested-by: Jason Gunthorpe <jgg@nvidia.com> > Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com> > Reviewed-by: John Hubbard <jhubbard@nvidia.com> > Reviewed-by: Mika Penttilä <mpenttil@redhat.com> > Reviewed-by: Jan Kara <jack@suse.cz> > Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> > --- > mm/gup.c | 43 ++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 42 insertions(+), 1 deletion(-) > > diff --git a/mm/gup.c b/mm/gup.c > index ff689c88a357..6e209ca10967 100644 > --- a/mm/gup.c > +++ b/mm/gup.c > @@ -959,16 +959,53 @@ static int faultin_page(struct vm_area_struct *vma, > return 0; > } > > +/* > + * Writing to file-backed mappings which require folio dirty tracking using GUP > + * is a fundamentally broken operation, as kernel write access to GUP mappings > + * do not adhere to the semantics expected by a file system. > + * > + * Consider the following scenario:- > + * > + * 1. A folio is written to via GUP which write-faults the memory, notifying > + * the file system and dirtying the folio. > + * 2. Later, writeback is triggered, resulting in the folio being cleaned and > + * the PTE being marked read-only. > + * 3. The GUP caller writes to the folio, as it is mapped read/write via the > + * direct mapping. > + * 4. The GUP caller, now done with the page, unpins it and sets it dirty > + * (though it does not have to). > + * > + * This results in both data being written to a folio without writenotify, and > + * the folio being dirtied unexpectedly (if the caller decides to do so). > + */ > +static bool writeable_file_mapping_allowed(struct vm_area_struct *vma, > + unsigned long gup_flags) > +{ > + /* > + * If we aren't pinning then no problematic write can occur. A long term > + * pin is the most egregious case so this is the case we disallow. > + */ > + if (!(gup_flags & (FOLL_PIN | FOLL_LONGTERM))) > + return true; If you really want to keep FOLL_PIN here ... this has to be if ((gup_flags & (FOLL_PIN | FOLL_LONGTERM)) != (FOLL_PIN | FOLL_LONGTERM)) or two separate checks. Otherwise you'd also proceed if only FOLL_PIN is set. Unless my tired eyes betrayed me.
On Tue, May 02, 2023 at 06:42:42PM +0200, David Hildenbrand wrote: > On 02.05.23 18:34, Lorenzo Stoakes wrote: > > Writing to file-backed mappings which require folio dirty tracking using > > GUP is a fundamentally broken operation, as kernel write access to GUP > > mappings do not adhere to the semantics expected by a file system. > > > > A GUP caller uses the direct mapping to access the folio, which does not > > cause write notify to trigger, nor does it enforce that the caller marks > > the folio dirty. > > > > The problem arises when, after an initial write to the folio, writeback > > results in the folio being cleaned and then the caller, via the GUP > > interface, writes to the folio again. > > > > As a result of the use of this secondary, direct, mapping to the folio no > > write notify will occur, and if the caller does mark the folio dirty, this > > will be done so unexpectedly. > > > > For example, consider the following scenario:- > > > > 1. A folio is written to via GUP which write-faults the memory, notifying > > the file system and dirtying the folio. > > 2. Later, writeback is triggered, resulting in the folio being cleaned and > > the PTE being marked read-only. > > 3. The GUP caller writes to the folio, as it is mapped read/write via the > > direct mapping. > > 4. The GUP caller, now done with the page, unpins it and sets it dirty > > (though it does not have to). > > > > This results in both data being written to a folio without writenotify, and > > the folio being dirtied unexpectedly (if the caller decides to do so). > > > > This issue was first reported by Jan Kara [1] in 2018, where the problem > > resulted in file system crashes. > > > > This is only relevant when the mappings are file-backed and the underlying > > file system requires folio dirty tracking. File systems which do not, such > > as shmem or hugetlb, are not at risk and therefore can be written to > > without issue. > > > > Unfortunately this limitation of GUP has been present for some time and > > requires future rework of the GUP API in order to provide correct write > > access to such mappings. > > > > However, for the time being we introduce this check to prevent the most > > egregious case of this occurring, use of the FOLL_LONGTERM pin. > > > > These mappings are considerably more likely to be written to after > > folios are cleaned and thus simply must not be permitted to do so. > > > > This patch changes only the slow-path GUP functions, a following patch > > adapts the GUP-fast path along similar lines. > > > > [1]:https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz/ > > > > Suggested-by: Jason Gunthorpe <jgg@nvidia.com> > > Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com> > > Reviewed-by: John Hubbard <jhubbard@nvidia.com> > > Reviewed-by: Mika Penttilä <mpenttil@redhat.com> > > Reviewed-by: Jan Kara <jack@suse.cz> > > Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> > > --- > > mm/gup.c | 43 ++++++++++++++++++++++++++++++++++++++++++- > > 1 file changed, 42 insertions(+), 1 deletion(-) > > > > diff --git a/mm/gup.c b/mm/gup.c > > index ff689c88a357..6e209ca10967 100644 > > --- a/mm/gup.c > > +++ b/mm/gup.c > > @@ -959,16 +959,53 @@ static int faultin_page(struct vm_area_struct *vma, > > return 0; > > } > > +/* > > + * Writing to file-backed mappings which require folio dirty tracking using GUP > > + * is a fundamentally broken operation, as kernel write access to GUP mappings > > + * do not adhere to the semantics expected by a file system. > > + * > > + * Consider the following scenario:- > > + * > > + * 1. A folio is written to via GUP which write-faults the memory, notifying > > + * the file system and dirtying the folio. > > + * 2. Later, writeback is triggered, resulting in the folio being cleaned and > > + * the PTE being marked read-only. > > + * 3. The GUP caller writes to the folio, as it is mapped read/write via the > > + * direct mapping. > > + * 4. The GUP caller, now done with the page, unpins it and sets it dirty > > + * (though it does not have to). > > + * > > + * This results in both data being written to a folio without writenotify, and > > + * the folio being dirtied unexpectedly (if the caller decides to do so). > > + */ > > +static bool writeable_file_mapping_allowed(struct vm_area_struct *vma, > > + unsigned long gup_flags) > > +{ > > + /* > > + * If we aren't pinning then no problematic write can occur. A long term > > + * pin is the most egregious case so this is the case we disallow. > > + */ > > + if (!(gup_flags & (FOLL_PIN | FOLL_LONGTERM))) > > + return true; > > If you really want to keep FOLL_PIN here ... this has to be > > if ((gup_flags & (FOLL_PIN | FOLL_LONGTERM)) != (FOLL_PIN | FOLL_LONGTERM)) > > or two separate checks. > > Otherwise you'd also proceed if only FOLL_PIN is set. > > Unless my tired eyes betrayed me. Your tired eyes are rapidly taking on the firey visage of the dark lord Sauron... but also, ugh god pints_owed_to_myself++. Sorry this was a me rushing it out of shame thing. Will fix on respin... apologies for spam everyone :) > > > -- > Thanks, > > David / dhildenb >
diff --git a/mm/gup.c b/mm/gup.c index ff689c88a357..6e209ca10967 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -959,16 +959,53 @@ static int faultin_page(struct vm_area_struct *vma, return 0; } +/* + * Writing to file-backed mappings which require folio dirty tracking using GUP + * is a fundamentally broken operation, as kernel write access to GUP mappings + * do not adhere to the semantics expected by a file system. + * + * Consider the following scenario:- + * + * 1. A folio is written to via GUP which write-faults the memory, notifying + * the file system and dirtying the folio. + * 2. Later, writeback is triggered, resulting in the folio being cleaned and + * the PTE being marked read-only. + * 3. The GUP caller writes to the folio, as it is mapped read/write via the + * direct mapping. + * 4. The GUP caller, now done with the page, unpins it and sets it dirty + * (though it does not have to). + * + * This results in both data being written to a folio without writenotify, and + * the folio being dirtied unexpectedly (if the caller decides to do so). + */ +static bool writeable_file_mapping_allowed(struct vm_area_struct *vma, + unsigned long gup_flags) +{ + /* + * If we aren't pinning then no problematic write can occur. A long term + * pin is the most egregious case so this is the case we disallow. + */ + if (!(gup_flags & (FOLL_PIN | FOLL_LONGTERM))) + return true; + + /* + * If the VMA does not require dirty tracking then no problematic write + * can occur either. + */ + return !vma_needs_dirty_tracking(vma); +} + static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) { vm_flags_t vm_flags = vma->vm_flags; int write = (gup_flags & FOLL_WRITE); int foreign = (gup_flags & FOLL_REMOTE); + bool vma_anon = vma_is_anonymous(vma); if (vm_flags & (VM_IO | VM_PFNMAP)) return -EFAULT; - if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) + if ((gup_flags & FOLL_ANON) && !vma_anon) return -EFAULT; if ((gup_flags & FOLL_LONGTERM) && vma_is_fsdax(vma)) @@ -978,6 +1015,10 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) return -EFAULT; if (write) { + if (!vma_anon && + !writeable_file_mapping_allowed(vma, gup_flags)) + return -EFAULT; + if (!(vm_flags & VM_WRITE)) { if (!(gup_flags & FOLL_FORCE)) return -EFAULT;