• Keno Fischer's avatar
    mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp · 8310d48b
    Keno Fischer authored
    In commit 19be0eaf ("mm: remove gup_flags FOLL_WRITE games from
    __get_user_pages()"), the mm code was changed from unsetting FOLL_WRITE
    after a COW was resolved to setting the (newly introduced) FOLL_COW
    instead.  Simultaneously, the check in gup.c was updated to still allow
    writes with FOLL_FORCE set if FOLL_COW had also been set.
    
    However, a similar check in huge_memory.c was forgotten.  As a result,
    remote memory writes to ro regions of memory backed by transparent huge
    pages cause an infinite loop in the kernel (handle_mm_fault sets
    FOLL_COW and returns 0 causing a retry, but follow_trans_huge_pmd bails
    out immidiately because `(flags & FOLL_WRITE) && !pmd_write(*pmd)` is
    true.
    
    While in this state the process is stil SIGKILLable, but little else
    works (e.g.  no ptrace attach, no other signals).  This is easily
    reproduced with the following code (assuming thp are set to always):
    
        #include <assert.h>
        #include <fcntl.h>
        #include <stdint.h>
        #include <stdio.h>
        #include <string.h>
        #include <sys/mman.h>
        #include <sys/stat.h>
        #include <sys/types.h>
        #include <sys/wait.h>
        #include <unistd.h>
    
        #define TEST_SIZE 5 * 1024 * 1024
    
        int main(void) {
          int status;
          pid_t child;
          int fd = open("/proc/self/mem", O_RDWR);
          void *addr = mmap(NULL, TEST_SIZE, PROT_READ,
                            MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
          assert(addr != MAP_FAILED);
          pid_t parent_pid = getpid();
          if ((child = fork()) == 0) {
            void *addr2 = mmap(NULL, TEST_SIZE, PROT_READ | PROT_WRITE,
                               MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
            assert(addr2 != MAP_FAILED);
            memset(addr2, 'a', TEST_SIZE);
            pwrite(fd, addr2, TEST_SIZE, (uintptr_t)addr);
            return 0;
          }
          assert(child == waitpid(child, &status, 0));
          assert(WIFEXITED(status) && WEXITSTATUS(status) == 0);
          return 0;
        }
    
    Fix this by updating follow_trans_huge_pmd in huge_memory.c analogously
    to the update in gup.c in the original commit.  The same pattern exists
    in follow_devmap_pmd.  However, we should not be able to reach that
    check with FOLL_COW set, so add WARN_ONCE to make sure we notice if we
    ever do.
    
    [akpm@linux-foundation.org: coding-style fixes]
    Link: http://lkml.kernel.org/r/20170106015025.GA38411@juliacomputing.comSigned-off-by: default avatarKeno Fischer <keno@juliacomputing.com>
    Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Greg Thelen <gthelen@google.com>
    Cc: Nicholas Piggin <npiggin@gmail.com>
    Cc: Willy Tarreau <w@1wt.eu>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    8310d48b
huge_memory.c 65 KB