From: Jens Axboe <axboe@kernel•dk>
To: Zorro Lang <zlang@redhat•com>, Nicholas Piggin <npiggin@gmail•com>
Cc: linuxppc-dev@lists•ozlabs.org
Subject: Re: [PATCH] powerpc/fault: fix wrong KUAP fault for IO_URING
Date: Thu, 28 Jan 2021 07:42:49 -0700 [thread overview]
Message-ID: <aedb880b-da2b-ec29-3b66-66f01733be9b@kernel.dk> (raw)
In-Reply-To: <20210128135220.GQ14354@localhost.localdomain>
On 1/28/21 6:52 AM, Zorro Lang wrote:
> On Wed, Jan 27, 2021 at 08:06:37PM -0700, Jens Axboe wrote:
>> On 1/27/21 8:13 PM, Zorro Lang wrote:
>>> On Thu, Jan 28, 2021 at 10:18:07AM +1000, Nicholas Piggin wrote:
>>>> Excerpts from Jens Axboe's message of January 28, 2021 5:29 am:
>>>>> On 1/27/21 9:38 AM, Christophe Leroy wrote:
>>>>>>
>>>>>>
>>>>>> Le 27/01/2021 à 15:56, Zorro Lang a écrit :
>>>>>>> On powerpc, io_uring test hit below KUAP fault on __do_page_fault.
>>>>>>> The fail source line is:
>>>>>>>
>>>>>>> if (unlikely(!is_user && bad_kernel_fault(regs, error_code, address, is_write)))
>>>>>>> return SIGSEGV;
>>>>>>>
>>>>>>> The is_user() is based on user_mod(regs) only. This's not suit for
>>>>>>> io_uring, where the helper thread can assume the user app identity
>>>>>>> and could perform this fault just fine. So turn to use mm to decide
>>>>>>> if this is valid or not.
>>>>>>
>>>>>> I don't understand why testing is_user would be an issue. KUAP purpose
>>>>>> it to block any unallowed access from kernel to user memory
>>>>>> (Equivalent to SMAP on x86). So it really must be based on MSR_PR bit,
>>>>>> that is what is_user provides.
>>>>>>
>>>>>> If the kernel access is legitimate, kernel should have opened
>>>>>> userspace access then you shouldn't get this "Bug: Read fault blocked
>>>>>> by KUAP!".
>>>>>>
>>>>>> As far as I understand, the fault occurs in
>>>>>> iov_iter_fault_in_readable() which calls fault_in_pages_readable() And
>>>>>> fault_in_pages_readable() uses __get_user() so it is a legitimate
>>>>>> access and you really should get a KUAP fault.
>>>>>>
>>>>>> So the problem is somewhere else, I think you proposed patch just
>>>>>> hides the problem, it doesn't fix it.
>>>>>
>>>>> If we do kthread_use_mm(), can we agree that the user access is valid?
>>>>
>>>> Yeah the io uring code is fine, provided it uses the uaccess primitives
>>>> like any other kernel code. It's looking more like a an arch/powerpc bug.
>>>>
>>>>> We should be able to copy to/from user space, and including faults, if
>>>>> that's been done and the new mm assigned. Because it really should be.
>>>>> If SMAP was a problem on x86, we would have seen it long ago.
>>>>>
>>>>> I'm assuming this may be breakage related to the recent uaccess changes
>>>>> related to set_fs and friends? Or maybe recent changes on the powerpc
>>>>> side?
>>>>>
>>>>> Zorro, did 5.10 work?
>>>>
>>>> Would be interesting to know.
>>>
>>> Sure Nick and Jens, which 5.10 rc? version do you want to know ? Or any git
>>> commit(be the HEAD) in 5.10 phase?
>>
>> I forget which versions had what series of this, but 5.10 final - and if
>> that fails, then 5.9 final. IIRC, 5.9 was pre any of these changes, and
>> 5.10 definitely has them.
>
> I justed built linux v5.10 with same .config file, and gave it same test.
> v5.10 (HEAD=2c85ebc57b Linux 5.10) can't reproduce this bug:
>
> # ./check generic/013 generic/051
> FSTYP -- xfs (non-debug)
> PLATFORM -- Linux/ppc64le ibm-p9z-xxx-xxxx 5.10.0 #3 SMP Thu Jan 28 04:12:14 EST 2021
> MKFS_OPTIONS -- -f -m crc=1,finobt=1,reflink=1,rmapbt=1,bigtime=1,inobtcount=1 /dev/sda3
> MOUNT_OPTIONS -- -o context=system_u:object_r:root_t:s0 /dev/sda3 /mnt/xfstests/scratch
>
> generic/013 138s ... 77s
> generic/051 103s ... 143s
> Ran: generic/013 generic/051
> Passed all 2 tests
Thanks for testing that, so I think it's safe to conclude that there's a
regression in powerpc fault handling for kthreads that use
kthread_use_mm in this release. A bisect would definitely find it, but
might be pointless if Christophe or Nick already have an idea of what it
is.
--
Jens Axboe
next prev parent reply other threads:[~2021-01-28 14:45 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-27 14:56 [PATCH] powerpc/fault: fix wrong KUAP fault for IO_URING Zorro Lang
2021-01-27 16:38 ` Christophe Leroy
2021-01-27 19:29 ` Jens Axboe
2021-01-28 0:18 ` Nicholas Piggin
2021-01-28 3:13 ` Zorro Lang
2021-01-28 3:06 ` Jens Axboe
2021-01-28 13:52 ` Zorro Lang
2021-01-28 14:42 ` Jens Axboe [this message]
2021-01-28 14:44 ` Christophe Leroy
2021-01-28 15:20 ` Zorro Lang
2021-01-29 6:52 ` Zorro Lang
2021-01-29 12:26 ` Christophe Leroy
2021-01-30 11:22 ` Michael Ellerman
2021-01-30 13:54 ` Nicholas Piggin
2021-02-02 4:45 ` Aneesh Kumar K.V
2021-02-02 5:55 ` Aneesh Kumar K.V
2021-02-02 6:02 ` Christophe Leroy
2021-02-02 6:16 ` Aneesh Kumar K.V
2021-02-02 6:20 ` Christophe Leroy
2021-02-02 6:30 ` Aneesh Kumar K.V
2021-02-02 9:49 ` Nicholas Piggin
2021-02-04 16:53 ` Jens Axboe
2021-02-04 17:01 ` Aneesh Kumar K.V
2021-02-04 17:03 ` Jens Axboe
2021-02-04 17:57 ` Zorro Lang
2021-02-04 17:42 ` Aneesh Kumar K.V
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aedb880b-da2b-ec29-3b66-66f01733be9b@kernel.dk \
--to=axboe@kernel$(echo .)dk \
--cc=linuxppc-dev@lists$(echo .)ozlabs.org \
--cc=npiggin@gmail$(echo .)com \
--cc=zlang@redhat$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox