tree 2d37f0bff4b46485a87d5dfafabf0bb390d98c6e
parent f7d0f46a7c9e27bf3bbc79cb8376c2046b753add
author Mike Rapoport <rppt@linux.vnet.ibm.com> 1528416565 -0700
committer Tim Zimmermann <tim@linux4.de> 1721966658 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuwYxAyE4TRnuhLgPbcIaY/gZxe8FAmajIEIACgkQbcIaY/gZ
 xe/kqhAAlFsB5p1HmI2J/BeyxoKd8LCKXMviDymj1RolEQMS3MkUk9Cve3X+eqYN
 Qm9sJxzraLLwTFMmXdfsuIR2s7Cj3qHptir8RYbxk0wbK88Z0+QgS3iWMuO304fd
 b4qNEMZPvbIfZVEGPMc/YUaqkQx9JHIzkz//F7BjyowCmkjkWJoG8CaK4IvGeXgj
 7OEiRGqEa5gWQ4KHgLu5p3JmlFDGXK2E8oRufEsl2dL01nDiRUFSoMvxwjrAWcoS
 NAjDh6KPi2/WOXXfQULhYBiHulKH4RVQNdd3RqIgzoKzDyWWLvaZwQ4y4qTnxxXS
 TNUuwR3/mMvrdg0RKMiF0t7i8Q2N/231oHCXs93q0ZbTteQtWBw/DBibk3e10sfC
 BA8paWHedjv4h12QKQqs9Pv42VARPKChODt0k8sxdTxiBgJZ0zWexyxPdG8uZa6G
 KqKOxUxpzayQHYWNXQWZzU9QMp0W+biiTr4CGHwNuVlc/Mr77iUBlQ3LACyu6I3Q
 XY18TKrxzlhK6vfOOJxzvdSHHSqVbLyblRngRbGD/xGA8GVYa+uvXEztInG3ClHW
 aM1CaZoVWt/Uz6zX8/563pHW6y8+y1DDDxynZ1sjHo9nIfmGWhWog9+qUVsi3dO4
 iM2p4QZH28x8iH3kjT8jcpoIw5snYw15mPmgXhOrCo3DRGD8YAM=
 =T3uE
 -----END PGP SIGNATURE-----

BACKPORT: userfaultfd: prevent non-cooperative events vs mcopy_atomic races

If a process monitored with userfaultfd changes it's memory mappings or
forks() at the same time as uffd monitor fills the process memory with
UFFDIO_COPY, the actual creation of page table entries and copying of
the data in mcopy_atomic may happen either before of after the memory
mapping modifications and there is no way for the uffd monitor to
maintain consistent view of the process memory layout.

For instance, let's consider fork() running in parallel with
userfaultfd_copy():

process        		         |	uffd monitor
---------------------------------+------------------------------
fork()        		         | userfaultfd_copy()
...        		         | ...
    dup_mmap()        	         |     down_read(mmap_sem)
    down_write(mmap_sem)         |     /* create PTEs, copy data */
        dup_uffd()               |     up_read(mmap_sem)
        copy_page_range()        |
        up_write(mmap_sem)       |
        dup_uffd_complete()      |
            /* notify monitor */ |

If the userfaultfd_copy() takes the mmap_sem first, the new page(s) will
be present by the time copy_page_range() is called and they will appear
in the child's memory mappings.  However, if the fork() is the first to
take the mmap_sem, the new pages won't be mapped in the child's address
space.

If the pages are not present and child tries to access them, the monitor
will get page fault notification and everything is fine.  However, if
the pages *are present*, the child can access them without uffd
noticing.  And if we copy them into child it'll see the wrong data.
Since we are talking about background copy, we'd need to decide whether
the pages should be copied or not regardless #PF notifications.

Since userfaultfd monitor has no way to determine what was the order,
let's disallow userfaultfd_copy in parallel with the non-cooperative
events.  In such case we return -EAGAIN and the uffd monitor can
understand that userfaultfd_copy() clashed with a non-cooperative event
and take an appropriate action.

Link: http://lkml.kernel.org/r/1527061324-19949-1-git-send-email-rppt@linux.vnet.ibm.com
Signed-off-by: Mike Rapoport <rppt@linux.vnet.ibm.com>
Acked-by: Pavel Emelyanov <xemul@virtuozzo.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Change-Id: I635affbde924a9f082b04c5b1361bf5f199d7323
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>