Re: [PATCH v2 6/9] mm: Make hugetlb mappings go through mm_get_unmapped_area_vmflags

[Oscar Salvador]

On Wed, Jul 31, 2024 at 05:08:24PM +0200, Oscar Salvador wrote:
> On Wed, Jul 31, 2024 at 12:02:47PM +0100, Lorenzo Stoakes wrote:
> > On Mon, Jul 29, 2024 at 11:10:15AM GMT, Oscar Salvador wrote:
> > >   * Someone wants to read @bytes from a HWPOISON hugetlb @page from @offset.
> > > @@ -1300,7 +1307,6 @@ static const struct file_operations hugetlbfs_file_operations = {
> > >  	.read_iter		= hugetlbfs_read_iter,
> > >  	.mmap			= hugetlbfs_file_mmap,
> > >  	.fsync			= noop_fsync,
> > > -	.get_unmapped_area	= hugetlb_get_unmapped_area,
> > 
> > This is causing a NULL pointer deref error in the mm self-tests,
> > specifically hugepage-shm.
> > 
> > This is because in __get_unmapped_area(), you check to see if the file has
> > an f_ops->get_unampped_area() however ('wonderfully'...) the shm stuff
> > wraps it, so this will be shm_get_unmapped_area() which then accesses the
> > underlying hugetlb file and _unconditionally_ calls
> > f_op->get_unmapped_area(), which you just made NULL and... kaboom :)
> > 
> > You can't even add null check in to this wrapper as at this point
> > everything assumes that you _can_ get an unmapped area. So yeah, it's kinda
> > broken.
> > 
> > This makes me think the whole thing is super-delicate and you probably need
> > to rethink this approach carefully, or least _very carefully_ audit users
> > of this operation.
> 
> Thanks for reporting this Lorenzo, highly appreciated.
> 
> I will check, but..
> 
> > By doing this you are causing an compilation error (at least on my compiler
> > with an x86-64 defconfig-based build):
> > 
> > arch/x86/mm/hugetlbpage.c:84:1: error: no previous prototype for
> > ‘hugetlb_get_unmapped_area’ [-Werror=missing-prototypes]
> >    84 | hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
> >       | ^~~~~~~~~~~~~~~~~~~~~~~~~
> 
> Something is off here.
> 
> git grep hugetlb_get_unmapped_area

Heh, of course I saw what is wrong after pressing intro.
Ok, with the entire series applied you should not see this problem as
hugetlb_get_unmapped_area gets totally wiped out, but checking out only
this commit indeed throws an error.

I will see how I can reshufle this.

thanks!


-- 
Oscar Salvador
SUSE Labs