On Sun, Nov 24, 2019 at 04:05:16PM -0800, John Hubbard wrote:
> I looked into this, and I believe that the problem is in gup.c. There appears to
> have been an oversight, in commit 817be129e6f2 ("mm: validate get_user_pages_fast
> flags"), in filtering out FOLL_FORCE. There is nothing in the _fast() implementation
> that requires that we avoid writing to the pages.
I think it is too late to be doing these kinds of changes, I will
revert the patch and this will miss this merge window.
Jason
>From ec6cb45292d21d1af9b9d95997b8cf204bbe854c Mon Sep 17 00:00:00 2001
From: Jason Gunthorpe <jgg@xxxxxxxxxxxx>
Date: Sun, 24 Nov 2019 20:47:59 -0400
Subject: [PATCH] Revert "IB/umem: use get_user_pages_fast() to pin DMA pages"
This reverts commit c9a7a2ed837c563f9f89743a6db732591cb4035b.
This was merged before enough testing was done, and it triggers a WARN_ON()
in get_user_pages_fast():
WARNING: CPU: 1 PID: 2557 at mm/gup.c:2404 get_user_pages_fast+0x115/0x180
Call Trace:
ib_umem_get+0x298/0x550 [ib_uverbs]
mlx5_ib_db_map_user+0xad/0x130 [mlx5_ib]
mlx5_ib_create_cq+0x1e8/0xaa0 [mlx5_ib]
create_cq+0x1c8/0x2d0 [ib_uverbs]
ib_uverbs_create_cq+0x70/0xa0 [ib_uverbs]
ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xc2/0xf0 [ib_uverbs]
ib_uverbs_cmd_verbs.isra.6+0x5be/0xbe0 [ib_uverbs]
? uverbs_disassociate_api+0xd0/0xd0 [ib_uverbs]
? kvm_clock_get_cycles+0xd/0x10
? kmem_cache_alloc+0x176/0x1c0
? filemap_map_pages+0x18c/0x350
ib_uverbs_ioctl+0xc0/0x120 [ib_uverbs]
do_vfs_ioctl+0xa1/0x610
ksys_ioctl+0x70/0x80
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x42/0x110
entry_SYSCALL_64_after_hwframe+0x44/0xa9
2404 if (WARN_ON_ONCE(gup_flags & ~(FOLL_WRITE | FOLL_LONGTERM)))
2405 return -EINVAL;
While we think this WARN_ON is probably bogus, resolving this will have to
wait.
Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxxxx>
---
drivers/infiniband/core/umem.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 214e87aa609d6e..7a3b99597eada1 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -266,13 +266,16 @@ struct ib_umem *ib_umem_get(struct ib_udata *udata, unsigned long addr,
sg = umem->sg_head.sgl;
while (npages) {
- ret = get_user_pages_fast(cur_base,
- min_t(unsigned long, npages,
- PAGE_SIZE /
- sizeof(struct page *)),
- gup_flags | FOLL_LONGTERM, page_list);
- if (ret < 0)
+ down_read(&mm->mmap_sem);
+ ret = get_user_pages(cur_base,
+ min_t(unsigned long, npages,
+ PAGE_SIZE / sizeof (struct page *)),
+ gup_flags | FOLL_LONGTERM,
+ page_list, NULL);
+ if (ret < 0) {
+ up_read(&mm->mmap_sem);
goto umem_release;
+ }
cur_base += ret * PAGE_SIZE;
npages -= ret;
@@ -280,6 +283,8 @@ struct ib_umem *ib_umem_get(struct ib_udata *udata, unsigned long addr,
sg = ib_umem_add_sg_table(sg, page_list, ret,
dma_get_max_seg_size(context->device->dma_device),
&umem->sg_nents);
+
+ up_read(&mm->mmap_sem);
}
sg_mark_end(sg);
--
2.24.0
