From nobody Mon Feb 9 19:05:56 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1667114032533100.39554077297043; Sun, 30 Oct 2022 00:13:52 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.432473.685233 (Exim 4.92) (envelope-from ) id 1op2VZ-0000Li-Ec; Sun, 30 Oct 2022 07:13:25 +0000 Received: by outflank-mailman (output) from mailman id 432473.685233; Sun, 30 Oct 2022 07:13:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1op2VZ-0000LX-BC; Sun, 30 Oct 2022 07:13:25 +0000 Received: by outflank-mailman (input) for mailman id 432473; Sun, 30 Oct 2022 07:13:23 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1op2VX-0008Dn-8I for xen-devel@lists.xenproject.org; Sun, 30 Oct 2022 07:13:23 +0000 Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 561f8869-5822-11ed-91b5-6bf2151ebd3b; Sun, 30 Oct 2022 08:13:22 +0100 (CET) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 6477E5C009A; Sun, 30 Oct 2022 03:13:21 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Sun, 30 Oct 2022 03:13:21 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 30 Oct 2022 03:13:20 -0400 (EDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 561f8869-5822-11ed-91b5-6bf2151ebd3b DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:sender:subject:subject:to:to; s=fm3; t= 1667114001; x=1667200401; bh=Mo8RRVU/BCqu317V/TpNAiSZ8pju9kQTzGf 3AAdnqs4=; b=dfcMRjyrXKkQpQBS2ci3HT1FA9DjFGnBeJHxaHlC2YWMZyKXbcD u4gflN0UpK3yanFBNARtumJ2QSY4VUFaOqJqqcndU4OdfsVgXvUz8O12EJHpj3xN 5YTs90DRWA0anrEVH6vRWr+mpzJ8KC0ieg+evYLhAwEkmt/tE16Jgnf8TQHmVB/M LpCZDu/wzaVHfLYuTX843kIMdVjOFYwRI+eCdgs1184yyqm+lTeyEFZse9IsQ+eC D1g9bXszG4JaO6eVP/2pr0Z2cXysBUDAkWcS3ZG5H8w1YN+9EVlnhH7EeiLiF7XA Kk2jc7BwrKsWeeWYBbeVmf+Ta6TF34a4mzQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; t=1667114001; x=1667200401; bh=Mo8RRVU/BCqu3 17V/TpNAiSZ8pju9kQTzGf3AAdnqs4=; b=NvntkGDBdJs9WghcSChl7hqL8t+fR mSWTzvbiAn4NEPDaPwEz6hSPwP6o6byVOn5WN3RBfnqDwqHgbct9zVc8dyNmbPAP aZQBBSIrBKqwx/04AZe9KC8YBAseu+lUH9Ky526b6Mq3hJCsQYvJsHmlNvqpvYGd i+Mo5sotrWQfPAK2qDSQ2Ronm8DkUZ1iY4AvnAiRYfNLFOkxCwiqqUoXSpRU7tR0 IAAuOTqlqC9oBPeHnMJyI8x5aRYS84zZioG5liJHF2lbyAwKyTF4HuG8gGjyuZzc a8ynS4nH2PsMw0FBZJfR+lpUYTDelfZS96M4eMdHvdcuFj3kbqKceObfg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvgedrtdelgdduudekucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhephffvvefufffkofgjfhgggfestdekredtredttdenucfhrhhomhepffgvmhhi ucforghrihgvucfqsggvnhhouhhruceouggvmhhisehinhhvihhsihgslhgvthhhihhngh hslhgrsgdrtghomheqnecuggftrfgrthhtvghrnheptedtgeduleekleevjeehhfdvkefh veeuvdevtdduhffhvdeltdegtdfgkeduudegnecuffhomhgrihhnpehgihhthhhusgdrtg homhdpkhgvrhhnvghlrdhorhhgnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghm pehmrghilhhfrhhomhepuggvmhhisehinhhvihhsihgslhgvthhhihhnghhslhgrsgdrtg homh X-ME-Proxy: Feedback-ID: iac594737:Fastmail From: Demi Marie Obenour To: Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Greg Kroah-Hartman , Sasha Levin , =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Cc: "M. Vefa Bicakci" , xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 3/3] xen/gntdev: Accommodate VMA splitting Date: Sun, 30 Oct 2022 03:12:43 -0400 Message-Id: <20221030071243.1580-4-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221030071243.1580-1-demi@invisiblethingslab.com> References: <20221030071243.1580-1-demi@invisiblethingslab.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1667114034469100005 Content-Type: text/plain; charset="utf-8" From: "M. Vefa Bicakci" Prior to this commit, the gntdev driver code did not handle the following scenario correctly with paravirtualized (PV) Xen domains: * User process sets up a gntdev mapping composed of two grant mappings (i.e., two pages shared by another Xen domain). * User process munmap()s one of the pages. * User process munmap()s the remaining page. * User process exits. In the scenario above, the user process would cause the kernel to log the following messages in dmesg for the first munmap(), and the second munmap() call would result in similar log messages: BUG: Bad page map in process doublemap.test pte:... pmd:... page:0000000057c97bff refcount:1 mapcount:-1 \ mapping:0000000000000000 index:0x0 pfn:... ... page dumped because: bad pte ... file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0 ... Call Trace: dump_stack_lvl+0x46/0x5e print_bad_pte.cold+0x66/0xb6 unmap_page_range+0x7e5/0xdc0 unmap_vmas+0x78/0xf0 unmap_region+0xa8/0x110 __do_munmap+0x1ea/0x4e0 __vm_munmap+0x75/0x120 __x64_sys_munmap+0x28/0x40 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb ... For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG) would print out the following and trigger a general protection fault in the affected Xen PV domain: (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ... (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ... As of this writing, gntdev_grant_map structure's vma field (referred to as map->vma below) is mainly used for checking the start and end addresses of mappings. However, with split VMAs, these may change, and there could be more than one VMA associated with a gntdev mapping. Hence, remove the use of map->vma and rely on map->pages_vm_start for the original start address and on (map->count << PAGE_SHIFT) for the original mapping size. Let the invalidate() and find_special_page() hooks use these. Also, given that there can be multiple VMAs associated with a gntdev mapping, move the "mmu_interval_notifier_remove(&map->notifier)" call to the end of gntdev_put_map, so that the MMU notifier is only removed after the closing of the last remaining VMA. Finally, use an atomic to prevent inadvertent gntdev mapping re-use, instead of using the map->live_grants atomic counter and/or the map->vma pointer (the latter of which is now removed). This prevents the userspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the same address range as a previously set up gntdev mapping. This scenario can be summarized with the following call-trace, which was valid prior to this commit: mmap gntdev_mmap mmap (repeat mmap with MAP_FIXED over the same address range) gntdev_invalidate unmap_grant_pages (sets 'being_removed' entries to true) gnttab_unmap_refs_async unmap_single_vma gntdev_mmap (maps the shared pages again) munmap gntdev_invalidate unmap_grant_pages (no-op because 'being_removed' entries are true) unmap_single_vma (For PV domains, Xen reports that a granted page is being unmapped and triggers a general protection fault in the affected domain, if Xen was built with CONFIG_DEBUG) The fix for this last scenario could be worth its own commit, but we opted for a single commit, because removing the gntdev_grant_map structure's vma field requires guarding the entry to gntdev_mmap(), and the live_grants atomic counter is not sufficient on its own to prevent the mmap() over a pre-existing mapping. Link: https://github.com/QubesOS/qubes-issues/issues/7631 Fixes: ab31523c2fca ("xen/gntdev: allow usermode to map granted pages") Cc: stable@vger.kernel.org Signed-off-by: M. Vefa Bicakci Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20221002222006.2077-3-m.v.b@runbox.com Signed-off-by: Juergen Gross --- drivers/xen/gntdev-common.h | 3 +- drivers/xen/gntdev.c | 58 ++++++++++++++++--------------------- 2 files changed, 27 insertions(+), 34 deletions(-) diff --git a/drivers/xen/gntdev-common.h b/drivers/xen/gntdev-common.h index 40ef379c28ab01a3a11008cb0f85a1b3fde134ca..9c286b2a19001616ae0e9986be1= 3905891b5f5ff 100644 --- a/drivers/xen/gntdev-common.h +++ b/drivers/xen/gntdev-common.h @@ -44,9 +44,10 @@ struct gntdev_unmap_notify { }; =20 struct gntdev_grant_map { + atomic_t in_use; struct mmu_interval_notifier notifier; + bool notifier_init; struct list_head next; - struct vm_area_struct *vma; int index; int count; int flags; diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c index 62a65122c73fbfe673405ce90a53c5f364b75082..862de00cfe89209cf28f7e7e87c= f325e40f1fc4b 100644 --- a/drivers/xen/gntdev.c +++ b/drivers/xen/gntdev.c @@ -276,6 +276,9 @@ void gntdev_put_map(struct gntdev_priv *priv, struct gn= tdev_grant_map *map) */ } =20 + if (use_ptemod && map->notifier_init) + mmu_interval_notifier_remove(&map->notifier); + if (map->notify.flags & UNMAP_NOTIFY_SEND_EVENT) { notify_remote_via_evtchn(map->notify.event); evtchn_put(map->notify.event); @@ -288,7 +291,7 @@ void gntdev_put_map(struct gntdev_priv *priv, struct gn= tdev_grant_map *map) static int find_grant_ptes(pte_t *pte, unsigned long addr, void *data) { struct gntdev_grant_map *map =3D data; - unsigned int pgnr =3D (addr - map->vma->vm_start) >> PAGE_SHIFT; + unsigned int pgnr =3D (addr - map->pages_vm_start) >> PAGE_SHIFT; int flags =3D map->flags | GNTMAP_application_map | GNTMAP_contains_pte; u64 pte_maddr; =20 @@ -513,11 +516,7 @@ static void gntdev_vma_close(struct vm_area_struct *vm= a) struct gntdev_priv *priv =3D file->private_data; =20 pr_debug("gntdev_vma_close %p\n", vma); - if (use_ptemod) { - WARN_ON(map->vma !=3D vma); - mmu_interval_notifier_remove(&map->notifier); - map->vma =3D NULL; - } + vma->vm_private_data =3D NULL; gntdev_put_map(priv, map); } @@ -545,29 +544,30 @@ static bool gntdev_invalidate(struct mmu_interval_not= ifier *mn, struct gntdev_grant_map *map =3D container_of(mn, struct gntdev_grant_map, notifier); unsigned long mstart, mend; + unsigned long map_start, map_end; =20 if (!mmu_notifier_range_blockable(range)) return false; =20 + map_start =3D map->pages_vm_start; + map_end =3D map->pages_vm_start + (map->count << PAGE_SHIFT); + /* * If the VMA is split or otherwise changed the notifier is not * updated, but we don't want to process VA's outside the modified * VMA. FIXME: It would be much more understandable to just prevent * modifying the VMA in the first place. */ - if (map->vma->vm_start >=3D range->end || - map->vma->vm_end <=3D range->start) + if (map_start >=3D range->end || map_end <=3D range->start) return true; =20 - mstart =3D max(range->start, map->vma->vm_start); - mend =3D min(range->end, map->vma->vm_end); + mstart =3D max(range->start, map_start); + mend =3D min(range->end, map_end); pr_debug("map %d+%d (%lx %lx), range %lx %lx, mrange %lx %lx\n", - map->index, map->count, - map->vma->vm_start, map->vma->vm_end, - range->start, range->end, mstart, mend); - unmap_grant_pages(map, - (mstart - map->vma->vm_start) >> PAGE_SHIFT, - (mend - mstart) >> PAGE_SHIFT); + map->index, map->count, map_start, map_end, + range->start, range->end, mstart, mend); + unmap_grant_pages(map, (mstart - map_start) >> PAGE_SHIFT, + (mend - mstart) >> PAGE_SHIFT); =20 return true; } @@ -1047,18 +1047,15 @@ static int gntdev_mmap(struct file *flip, struct vm= _area_struct *vma) return -EINVAL; =20 pr_debug("map %d+%d at %lx (pgoff %lx)\n", - index, count, vma->vm_start, vma->vm_pgoff); + index, count, vma->vm_start, vma->vm_pgoff); =20 mutex_lock(&priv->lock); map =3D gntdev_find_map_index(priv, index, count); if (!map) goto unlock_out; - if (use_ptemod && map->vma) + if (!atomic_add_unless(&map->in_use, 1, 1)) goto unlock_out; - if (atomic_read(&map->live_grants)) { - err =3D -EAGAIN; - goto unlock_out; - } + refcount_inc(&map->users); =20 vma->vm_ops =3D &gntdev_vmops; @@ -1079,15 +1076,16 @@ static int gntdev_mmap(struct file *flip, struct vm= _area_struct *vma) map->flags |=3D GNTMAP_readonly; } =20 + map->pages_vm_start =3D vma->vm_start; + if (use_ptemod) { - map->vma =3D vma; err =3D mmu_interval_notifier_insert_locked( &map->notifier, vma->vm_mm, vma->vm_start, vma->vm_end - vma->vm_start, &gntdev_mmu_ops); - if (err) { - map->vma =3D NULL; + if (err) goto out_unlock_put; - } + + map->notifier_init =3D true; } mutex_unlock(&priv->lock); =20 @@ -1104,7 +1102,6 @@ static int gntdev_mmap(struct file *flip, struct vm_a= rea_struct *vma) */ mmu_interval_read_begin(&map->notifier); =20 - map->pages_vm_start =3D vma->vm_start; err =3D apply_to_page_range(vma->vm_mm, vma->vm_start, vma->vm_end - vma->vm_start, find_grant_ptes, map); @@ -1150,13 +1147,8 @@ static int gntdev_mmap(struct file *flip, struct vm_= area_struct *vma) out_unlock_put: mutex_unlock(&priv->lock); out_put_map: - if (use_ptemod) { + if (use_ptemod) unmap_grant_pages(map, 0, map->count); - if (map->vma) { - mmu_interval_notifier_remove(&map->notifier); - map->vma =3D NULL; - } - } gntdev_put_map(priv, map); return err; } --=20 2.38.1