On Tue, Sep 22, 2020 at 12:30 AM Peter Xu <peterx@xxxxxxxxxx> wrote:
> On Mon, Sep 21, 2020 at 11:43:38PM +0200, Jann Horn wrote:
> > On Mon, Sep 21, 2020 at 11:17 PM Peter Xu <peterx@xxxxxxxxxx> wrote:
> > > (Commit message collected from Jason Gunthorpe)
> > >
> > > Reduce the chance of false positive from page_maybe_dma_pinned() by keeping
> > > track if the mm_struct has ever been used with pin_user_pages(). mm_structs
> > > that have never been passed to pin_user_pages() cannot have a positive
> > > page_maybe_dma_pinned() by definition.
> >
> > There are some caveats here, right? E.g. this isn't necessarily true
> > for pagecache pages, I think?
>
> Sorry I didn't follow here. Could you help explain with some details?
The commit message says "mm_structs that have never been passed to
pin_user_pages() cannot have a positive page_maybe_dma_pinned() by
definition"; but that is not true for pages which may also be mapped
in a second mm and may have been passed to pin_user_pages() through
that second mm (meaning they must be writable over there and not
shared with us via CoW).
For example:
Process A:
fd_a = open("/foo/bar", O_RDWR);
mapping_a = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, fd_a, 0);
pin_user_pages(mapping_a, 1, ...);
Process B:
fd_b = open("/foo/bar", O_RDONLY);
mapping_b = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd_b, 0);
*(volatile char *)mapping_b;
At this point, process B has never called pin_user_pages(), but
page_maybe_dma_pinned() on the page at mapping_b would return true.
I don't think this is a problem for the use of page_maybe_dma_pinned()
in fork(), but I do think that the commit message is not entirely
correct.
