|
| 1 | +From 9b1ab7cc1eb019d9e8ce1b63954c58eb0fbecd2c Mon Sep 17 00:00:00 2001 |
| 2 | +From: Asahi Lina < [email protected]> |
| 3 | +Date: Mon, 21 Oct 2024 23:21:16 +0900 |
| 4 | +Subject: [PATCH 2/2] mm: Fix __wp_page_copy_user fallback path for remote mm |
| 5 | + |
| 6 | +If the source page is a PFN mapping, we copy back from userspace. |
| 7 | +However, if this fault is a remote access, we cannot use |
| 8 | +__copy_from_user_inatomic. Instead, use access_remote_vm() in this case. |
| 9 | + |
| 10 | +Fixes WARN when writing to CoW mappings into a remote process, such as |
| 11 | +when using gdb on a binary present on a DAX filesystem. |
| 12 | + |
| 13 | +[ 143.683782] ------------[ cut here ]------------ |
| 14 | +[ 143.683784] WARNING: CPU: 1 PID: 350 at mm/memory.c:2904 __wp_page_copy_user+0x120/0x2bc |
| 15 | +[ 143.683793] CPU: 1 PID: 350 Comm: gdb Not tainted 6.6.52 #1 |
| 16 | +[ 143.683794] Hardware name: linux,dummy-virt (DT) |
| 17 | +[ 143.683795] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) |
| 18 | +[ 143.683796] pc : __wp_page_copy_user+0x120/0x2bc |
| 19 | +[ 143.683798] lr : __wp_page_copy_user+0x254/0x2bc |
| 20 | +[ 143.683799] sp : ffff80008272b8b0 |
| 21 | +[ 143.683799] x29: ffff80008272b8b0 x28: 0000000000000000 x27: ffff000083bad580 |
| 22 | +[ 143.683801] x26: 0000000000000000 x25: 0000fffff7fd5000 x24: ffff000081db04c0 |
| 23 | +[ 143.683802] x23: ffff00014f24b000 x22: fffffc00053c92c0 x21: ffff000083502150 |
| 24 | +[ 143.683803] x20: 0000fffff7fd5000 x19: ffff80008272b9d0 x18: 0000000000000000 |
| 25 | +[ 143.683804] x17: ffff000081db0500 x16: ffff800080fe52a0 x15: 0000fffff7fd5000 |
| 26 | +[ 143.683804] x14: 0000000000bb1845 x13: 0000000000000080 x12: ffff80008272b880 |
| 27 | +[ 143.683805] x11: ffff000081d13600 x10: ffff000081d13608 x9 : ffff000081d1360c |
| 28 | +[ 143.683806] x8 : ffff000083a16f00 x7 : 0000000000000010 x6 : ffff00014f24b000 |
| 29 | +[ 143.683807] x5 : ffff00014f24c000 x4 : 0000000000000000 x3 : ffff000083582000 |
| 30 | +[ 143.683807] x2 : 0000000000000f80 x1 : 0000fffff7fd5000 x0 : 0000000000001000 |
| 31 | +[ 143.683808] Call trace: |
| 32 | +[ 143.683809] __wp_page_copy_user+0x120/0x2bc |
| 33 | +[ 143.683810] wp_page_copy+0x98/0x5c0 |
| 34 | +[ 143.683813] do_wp_page+0x250/0x530 |
| 35 | +[ 143.683814] __handle_mm_fault+0x278/0x284 |
| 36 | +[ 143.683817] handle_mm_fault+0x64/0x1e8 |
| 37 | +[ 143.683819] faultin_page+0x5c/0x110 |
| 38 | +[ 143.683820] __get_user_pages+0xc8/0x2f4 |
| 39 | +[ 143.683821] get_user_pages_remote+0xac/0x30c |
| 40 | +[ 143.683823] __access_remote_vm+0xb4/0x368 |
| 41 | +[ 143.683824] access_remote_vm+0x10/0x1c |
| 42 | +[ 143.683826] mem_rw.isra.0+0xc4/0x218 |
| 43 | +[ 143.683831] mem_write+0x18/0x24 |
| 44 | +[ 143.683831] vfs_write+0xa0/0x37c |
| 45 | +[ 143.683834] ksys_pwrite64+0x7c/0xc0 |
| 46 | +[ 143.683834] __arm64_sys_pwrite64+0x20/0x2c |
| 47 | +[ 143.683835] invoke_syscall+0x48/0x10c |
| 48 | +[ 143.683837] el0_svc_common.constprop.0+0x40/0xe0 |
| 49 | +[ 143.683839] do_el0_svc+0x1c/0x28 |
| 50 | +[ 143.683841] el0_svc+0x3c/0xdc |
| 51 | +[ 143.683846] el0t_64_sync_handler+0x120/0x12c |
| 52 | +[ 143.683848] el0t_64_sync+0x194/0x198 |
| 53 | +[ 143.683849] ---[ end trace 0000000000000000 ]--- |
| 54 | + |
| 55 | +Signed-off-by: Asahi Lina < [email protected]> |
| 56 | +--- |
| 57 | + mm/memory.c | 7 ++++++- |
| 58 | + 1 file changed, 6 insertions(+), 1 deletion(-) |
| 59 | + |
| 60 | +diff --git a/mm/memory.c b/mm/memory.c |
| 61 | +index ebfc9768f801..277079edd24b 100644 |
| 62 | +--- a/mm/memory.c |
| 63 | ++++ b/mm/memory.c |
| 64 | +@@ -3078,13 +3078,18 @@ static inline int __wp_page_copy_user(struct page *dst, struct page *src, |
| 65 | + update_mmu_cache_range(vmf, vma, addr, vmf->pte, 1); |
| 66 | + } |
| 67 | + |
| 68 | ++ /* If the mm is a remote mm, copy in the page using access_remote_vm() */ |
| 69 | ++ if (current->mm != mm) { |
| 70 | ++ if (access_remote_vm(mm, (unsigned long)uaddr, kaddr, PAGE_SIZE, 0) != PAGE_SIZE) |
| 71 | ++ goto warn; |
| 72 | ++ } |
| 73 | + /* |
| 74 | + * This really shouldn't fail, because the page is there |
| 75 | + * in the page tables. But it might just be unreadable, |
| 76 | + * in which case we just give up and fill the result with |
| 77 | + * zeroes. |
| 78 | + */ |
| 79 | +- if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) { |
| 80 | ++ else if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) { |
| 81 | + if (vmf->pte) |
| 82 | + goto warn; |
| 83 | + |
| 84 | +-- |
| 85 | +2.47.0 |
| 86 | + |
0 commit comments