Commit 67695f18 authored by Lokesh Gidra's avatar Lokesh Gidra Committed by Andrew Morton
Browse files

userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb 

In mfill_atomic_hugetlb(), mmap_changing isn't being checked
again if we drop mmap_lock and reacquire it. When the lock is not held,
mmap_changing could have been incremented. This is also inconsistent
with the behavior in mfill_atomic().

Link: https://lkml.kernel.org/r/20240117223729.1444522-1-lokeshgidra@google.com


Fixes: df2cc96e ("userfaultfd: prevent non-cooperative events vs mcopy_atomic races") 
Signed-off-by: default avatarLokesh Gidra <lokeshgidra@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Nicolas Geoffray <ngeoffray@google.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent d021b442

mm/userfaultfd.c

+13 −2
Original line number Diff line number Diff line
@@ -357,6 +357,7 @@ static __always_inline ssize_t mfill_atomic_hugetlb( 
					      unsigned long dst_start,

					      unsigned long src_start,

					      unsigned long len,

					      atomic_t *mmap_changing,

					      uffd_flags_t flags)

{

	struct mm_struct *dst_mm = dst_vma->vm_mm;
@@ -472,6 +473,15 @@ static __always_inline ssize_t mfill_atomic_hugetlb( 
				goto out;

			}

			mmap_read_lock(dst_mm);

			/*

			 * If memory mappings are changing because of non-cooperative

			 * operation (e.g. mremap) running in parallel, bail out and

			 * request the user to retry later

			 */

			if (mmap_changing && atomic_read(mmap_changing)) {

				err = -EAGAIN;

				break;

			}



			dst_vma = NULL;

			goto retry;
@@ -506,6 +516,7 @@ extern ssize_t mfill_atomic_hugetlb(struct vm_area_struct *dst_vma, 
				    unsigned long dst_start,

				    unsigned long src_start,

				    unsigned long len,

				    atomic_t *mmap_changing,

				    uffd_flags_t flags);

#endif /* CONFIG_HUGETLB_PAGE */
@@ -622,8 +633,8 @@ static __always_inline ssize_t mfill_atomic(struct mm_struct *dst_mm, 
	 * If this is a HUGETLB vma, pass off to appropriate routine

	 */

	if (is_vm_hugetlb_page(dst_vma))

		return  mfill_atomic_hugetlb(dst_vma, dst_start,

					     src_start, len, flags);

		return  mfill_atomic_hugetlb(dst_vma, dst_start, src_start,

					     len, mmap_changing, flags);



	if (!vma_is_anonymous(dst_vma) && !vma_is_shmem(dst_vma))

		goto out_unlock;