RE: [EXT] Re: vfio-pci: protect remap_pfn_range() from simultaneous calls

[Bharat Bhushan]

> -----Original Message-----
> From: Ankur Arora <ankur.a.arora@xxxxxxxxxx>
> Sent: Wednesday, January 6, 2021 11:44 PM
> To: Bharat Bhushan <bbhushan2@xxxxxxxxxxx>; alex.williamson@xxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx; Sunil Kovvuri Goutham
> <sgoutham@xxxxxxxxxxx>
> Subject: [EXT] Re: vfio-pci: protect remap_pfn_range() from simultaneous calls
> 
> External Email
> 
> ----------------------------------------------------------------------
> On 2021-01-06 8:17 a.m., Bharat Bhushan wrote:
> > Hi Ankur,
> >
> > We are observing below BUG_ON() with latest kernel
> >
> >     [10011.321645] ------------[ cut here ]------------
> >     [10011.322262] kernel BUG at mm/memory.c:1816!
> >     [10011.323793] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> >     [10011.326108] CPU: 2 PID: 1147 Comm: odp_l2fwd Not tainted 5.4.74-05938-
> gb9598e49fe61 #15
> >     [10011.328272] Hardware name: Marvell CN106XX board (DT)
> >     [10011.330328] pstate: 80400009 (Nzcv daif +PAN -UAO)
> >     [10011.332402] pc : remap_pfn_range+0x1a4/0x260
> >     [10011.334383] lr : remap_pfn_range+0x14c/0x260
> >     [10011.335911] sp : ffff8000156afc10
> >     [10011.337360] x29: ffff8000156afc10 x28: ffffffdffa240000
> >     [10011.339671] x27: ffff00014a241000 x26: 0000002182000000
> >     [10011.341984] x25: ffff0001489fbe00 x24: 0000002182040000
> >     [10011.344279] x23: 0000002182040000 x22: 0068000000000fc3
> >     [10011.346539] x21: 0000002182040000 x20: ffff000149d70860
> >     [10011.348846] x19: 0000000000000041 x18: 0000000000000000
> >     [10011.351064] x17: 0000000000000000 x16: 0000000000000000
> >     [10011.353304] x15: 0000000000000000 x14: 0000000000000000
> >     [10011.355519] x13: 0000000000000000 x12: 0000000000000000
> >     [10011.357812] x11: 0000000000000000 x10: ffffffdfffe00000
> >     [10011.360136] x9 : 0000000000000000 x8 : 0000000000000000
> >     [10011.362414] x7 : 0000000000000000 x6 : 0000042182000000
> >     [10011.364773] x5 : 0001000000000000 x4 : 0000000000000000
> >     [10011.367103] x3 : ffffffe000328928 x2 : 016800017c240fc3
> >     [10011.369462] x1 : 0000000000000000 x0 : ffffffe000328928
> >     [10011.371694] Call trace:
> >     [10011.373510]  remap_pfn_range+0x1a4/0x260
> >     [10011.375386]  vfio_pci_mmap_fault+0x9c/0x114
> >     [10011.377346]  __do_fault+0x38/0x100
> >     [10011.379253]  __handle_mm_fault+0x81c/0xce4
> >     [10011.381247]  handle_mm_fault+0xb4/0x17c
> >     [10011.383220]  do_page_fault+0x110/0x430
> >     [10011.385188]  do_translation_fault+0x80/0x90
> >     [10011.387069]  do_mem_abort+0x3c/0xa0
> >     [10011.388852]  el0_da+0x20/0x24
> >     [10011.391239] Code: eb1a02ff 54000080 f9400362 b4fffe42 (d4210000)
> >     [10011.393306] ---[ end trace ae8b75b32426d53c ]---
> >     [10011.395140] note: odp_l2fwd[1147] exited with preempt_count 2
> >
> > This is observed after patch "vfio-pci: Fault mmaps to enable vma tracking"
> where actual mapping delayed on page fault.
> > When address of same page accessed by multiple threads at/around same time
> by threads running on different cores causes page fault for same page on multiple
> cores at same time. One of the fault hander creates mapping while second hander
> find that page-table mapping already exists and leads to above kernel BUG_ON().
> 
> Yeah, that's what my fix addressed as well.
> 
> >
> > While article  https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__lwn.net_Articles_828536_&d=DwICaQ&c=nKjWec2b6R0mOyPaz7xtfQ&r=PAAl
> WswPe7d8gHlGbCLmy2YezyK7O3Hv_t2heGnouBw&m=HdwvdpkmrBJoQ0VZHxyHS
> K0T_43_msSxaKD_DlLoGWM&s=3ACed-
> _mL6h2DFbGHl0E5SucG5w4QEDRoKeO7cxpnKU&e=  suggest that you have
> already faced and fixed this issue
> >         "- vfio-pci: protect remap_pfn_range() from simultaneous calls (Ankur  Arora)
> [Orabug: 31663628] {CVE-2020-12888} {CVE-2020-12888}"
> >
> > But I do not see any patch submitted or under review in upstream, hopefully I did
> not missed some discussion. Please let us know in case you already submitted or
> planning to submit fix or someone else fixed same.
> 
> No you haven't missed a discussion on this. For upstream this was more of a
> theoretical race so I dallied a bit before sending the patch upstream.
> 
> I'll submit a patch soon. Also, would you mind if I ask you to run this failing test
> before submission?

Sure we will review and test.

Thanks
-Bharat

> 
> Thanks
> Ankur
> 
> >
> > Thanks
> > -Bharat
> >