From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 80439 invoked by alias); 16 Mar 2015 19:03:53 -0000 Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org Received: (qmail 80428 invoked by uid 89); 16 Mar 2015 19:03:53 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-3.8 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham version=3.3.2 X-HELO: mx1.redhat.com Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES256-GCM-SHA384 encrypted) ESMTPS; Mon, 16 Mar 2015 19:03:52 +0000 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t2GJ3lpU027153 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 16 Mar 2015 15:03:47 -0400 Received: from tranklukator.brq.redhat.com (dhcp-1-208.brq.redhat.com [10.34.1.208]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with SMTP id t2GJ3iEg018769; Mon, 16 Mar 2015 15:03:45 -0400 Received: by tranklukator.brq.redhat.com (nbSMTP-1.00) for uid 500 oleg@redhat.com; Mon, 16 Mar 2015 20:01:57 +0100 (CET) Date: Mon, 16 Mar 2015 19:03:00 -0000 From: Oleg Nesterov To: Andy Lutomirski , Hugh Dickins , Linus Torvalds Cc: Jan Kratochvil , Sergio Durigan Junior , GDB Patches , Pedro Alves , "linux-kernel@vger.kernel.org" Subject: install_special_mapping && vm_pgoff (Was: vvar, gup && coredump) Message-ID: <20150316190154.GA18472@redhat.com> References: <878ufc9kau.fsf@redhat.com> <20150305154827.GA9441@host1.jankratochvil.net> <87zj7r5fpz.fsf@redhat.com> <20150305205744.GA13165@host1.jankratochvil.net> <20150311200052.GA22654@redhat.com> <20150312143438.GA4338@redhat.com> <20150312165423.GA10073@redhat.com> <20150312174653.GA13086@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150312174653.GA13086@redhat.com> User-Agent: Mutt/1.5.18 (2008-05-17) X-SW-Source: 2015-03/txt/msg00466.txt.bz2 On 03/12, Oleg Nesterov wrote: > > OTOH. We can probably add ->access() into special_mapping_vmops, this > way __access_remote_vm() could work even if gup() fails ? So I tried to think how special_mapping_vmops->access() can work, it needs to rely on ->vm_pgoff. But afaics this logic is just broken. Lets even forget about vvar vma which uses remap_file_pages(). Lets look at "[vdso]" which uses the "normal" pages. The comment in special_mapping_fault() says * special mappings have no vm_file, and in that case, the mm * uses vm_pgoff internally. Yes. But afaics mm/ doesn't do this correctly. So * do not copy this code into drivers! looks like a good recommendation ;) I think that this logic is wrong even if ARRAY_SIZE(pages) == 1, but I am not sure. But since vdso use 2 pages, it is trivial to show that this logic is wrong. To verify, I changed show_map_vma() to expose pgoff even if !file, but this test-case can show the problem too: #include #include #include #include #include #include void *find_vdso_vaddr(void) { FILE *perl; char buf[32] = {}; perl = popen("perl -e 'open STDIN,qq|/proc/@{[getppid]}/maps|;" "/^(.*?)-.*vdso/ && print hex $1 while <>'", "r"); fread(buf, sizeof(buf), 1, perl); fclose(perl); return (void *)atol(buf); } #define PAGE_SIZE 4096 int main(void) { void *vdso = find_vdso_vaddr(); assert(vdso); // of course they should differ, and they do so far printf("vdso pages differ: %d\n", !!memcmp(vdso, vdso + PAGE_SIZE, PAGE_SIZE)); // split into 2 vma's assert(mprotect(vdso, PAGE_SIZE, PROT_READ) == 0); // force another fault on the next check assert(madvise(vdso, 2 * PAGE_SIZE, MADV_DONTNEED) == 0); // now they no longer differ, the 2nd vm_pgoff is wrong printf("vdso pages differ: %d\n", !!memcmp(vdso, vdso + PAGE_SIZE, PAGE_SIZE)); return 0; } output: vdso pages differ: 1 vdso pages differ: 0 And not only "split_vma" is wrong, I think that "move_vma" is not right too. Note this check in copy_vma(), /* * If anonymous vma has not yet been faulted, update new pgoff * to match new location, to increase its chance of merging. */ if (unlikely(!vma->vm_file && !vma->anon_vma)) { pgoff = addr >> PAGE_SHIFT; faulted_in_anon_vma = false; } I can easily misread this code. But it doesn't look right too. If vdso was cow'ed (breakpoint installed by gdb) and sys_nremap()'ed, then the new pgoff will be wrong too after, say, MADV_DONTNEED. Or I am totally confused? Oleg.