| Message ID | 5011977-d876-6a24-a3fc-c7e6a02877b8@google.com |
|---|---|
| State | New |
| Headers | show |
| Series | arch: allow pte_offset_map[_lock]() to fail | expand |
On Tue, May 09, 2023 at 09:42:44PM -0700, Hugh Dickins wrote: > diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c > index e4c2677cc1e9..2f6163f05e93 100644 > --- a/arch/arm/lib/uaccess_with_memcpy.c > +++ b/arch/arm/lib/uaccess_with_memcpy.c > @@ -74,6 +74,9 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) > return 0; > > pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl); > + if (unlikely(!pte)) > + return 0; Failing seems like the wrong thig to do if we transitioned from a PTE to PMD here? Looks to me like we should goto a new label right after the 'pmd = pmd_offset(pud, addr);', no?
On Wed, 10 May 2023, Matthew Wilcox wrote: > On Tue, May 09, 2023 at 09:42:44PM -0700, Hugh Dickins wrote: > > diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c > > index e4c2677cc1e9..2f6163f05e93 100644 > > --- a/arch/arm/lib/uaccess_with_memcpy.c > > +++ b/arch/arm/lib/uaccess_with_memcpy.c > > @@ -74,6 +74,9 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) > > return 0; > > > > pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl); > > + if (unlikely(!pte)) > > + return 0; > > Failing seems like the wrong thig to do if we transitioned from a PTE > to PMD here? Looks to me like we should goto a new label right after > the 'pmd = pmd_offset(pud, addr);', no? I'm pretty sure it's right as is; but probably more by luck than care - I do not think I studied this code as closely as you have now made me do; and it's clear that this is a piece of code where rare transient issues could come up, and must be handled correctly. Thank you for making me look again. The key is in the callers of pin_page_for_write(): __copy_to_user_memcpy() and __clear_user_memset(). They're doing "while (!pin_page_for_write())" loops - they hope for the fast path of getting pte_lock or pmd_lock on the page, and doing a __memcpy() or __memset() to the user address; but if anything goes "wrong", a __put_user() to fault in the page (or fail) then pin_page_for_write() again. "if (unlikely(!pte)) return 0" says that the expected fast path did not succeed, so please __put_user() and have another go. It is somewhere I could have done a "goto again", but that would be superfluous when it's already designed that way at the outer level. Hugh
diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c index e4c2677cc1e9..2f6163f05e93 100644 --- a/arch/arm/lib/uaccess_with_memcpy.c +++ b/arch/arm/lib/uaccess_with_memcpy.c @@ -74,6 +74,9 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) return 0; pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl); + if (unlikely(!pte)) + return 0; + if (unlikely(!pte_present(*pte) || !pte_young(*pte) || !pte_write(*pte) || !pte_dirty(*pte))) { pte_unmap_unlock(pte, ptl); diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c index 0e49154454a6..ca5302b0b7ee 100644 --- a/arch/arm/mm/fault-armv.c +++ b/arch/arm/mm/fault-armv.c @@ -117,8 +117,11 @@ static int adjust_pte(struct vm_area_struct *vma, unsigned long address, * must use the nested version. This also means we need to * open-code the spin-locking. */ - ptl = pte_lockptr(vma->vm_mm, pmd); pte = pte_offset_map(pmd, address); + if (!pte) + return 0; + + ptl = pte_lockptr(vma->vm_mm, pmd); do_pte_lock(ptl); ret = do_adjust_pte(vma, address, pfn, pte); diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index 2418f1efabd8..83598649a094 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -85,6 +85,9 @@ void show_pte(const char *lvl, struct mm_struct *mm, unsigned long addr) break; pte = pte_offset_map(pmd, addr); + if (!pte) + break; + pr_cont(", *pte=%08llx", (long long)pte_val(*pte)); #ifndef CONFIG_ARM_LPAE pr_cont(", *ppte=%08llx",
In rare transient cases, not yet made possible, pte_offset_map() and pte_offset_map_lock() may not find a page table: handle appropriately. Signed-off-by: Hugh Dickins <hughd@google.com> --- arch/arm/lib/uaccess_with_memcpy.c | 3 +++ arch/arm/mm/fault-armv.c | 5 ++++- arch/arm/mm/fault.c | 3 +++ 3 files changed, 10 insertions(+), 1 deletion(-)