[PATCH V2 2/3] mm/hugetlb: disable PMD sharing for UFFD missing mode

[Li Zhe]

From: "David Hildenbrand (Arm)" <david@xxxxxxxxxx>

For UFFDIO_POISON to install a poison marker in a hugetlb mapping, it is
sufficient to have the VMA registered for missing mode.

However, UFFD missing mode does currently not block PMD table sharing, so
installing the marker will be visible to everyone using the shared PMD
table, which is wrong as UFFDIO_POISON must stay local to the process.

To fix it, include VM_UFFD_MISSING in uffd_disable_huge_pmd_share(). Add
a debug check on the marker installation path.

The existing registration path will then unshare PMD tables, and
subsequent faults will not share them while the mapping remains
registered.

The alternative would be to unshare PMD tables selectively when
installing poison markers, which results in way more complexity. Or
alternatively, simply failing the marker installation, which might break
some use cases.

This effectively disables PMD sharing for missing-mode registrations
that never use UFFDIO_POISON.

Suggested-by: Li Zhe <lizhe.67@xxxxxxxxxxxxx>
Fixes: 8a13897fb0da ("mm: userfaultfd: support UFFDIO_POISON for hugetlbfs")
Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
Signed-off-by: Li Zhe <lizhe.67@xxxxxxxxxxxxx>
---
 include/linux/userfaultfd_k.h | 13 +++++++++----
 mm/hugetlb.c                  |  1 +
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
index a4351cffc60c..fe78ba14dc68 100644
--- a/include/linux/userfaultfd_k.h
+++ b/include/linux/userfaultfd_k.h
@@ -169,7 +169,10 @@ static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
 }
 
 /*
- * Never enable huge pmd sharing on some uffd registered vmas:
+ * Never enable huge pmd sharing on the following VMAs:
+ *
+ * - VM_UFFD_MISSING VMAs, because UFFDIO_POISON may install markers and we
+ *   want PMD tables to be unshared when installing these markers already.
  *
  * - VM_UFFD_WP and VM_UFFD_RWP VMAs, because the write protect / access
  *   tracking information is per pgtable entry.
@@ -182,9 +185,11 @@ static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
  */
 static inline bool uffd_disable_huge_pmd_share(struct vm_area_struct *vma)
 {
-	return vma_test_any_mask(vma,
-		mk_vma_flags_from_masks(VMA_UFFD_WP, VMA_UFFD_RWP,
-					VMA_UFFD_MINOR));
+	const vma_flags_t uffd_flags =
+		mk_vma_flags_from_masks(VMA_UFFD_MISSING, VMA_UFFD_WP,
+					VMA_UFFD_RWP, VMA_UFFD_MINOR);
+
+	return vma_test_any_mask(vma, uffd_flags);
 }
 
 /*
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 2c64ca985dfa..fdd65e019a55 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6304,6 +6304,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte,
 			return -EEXIST;
 		}
 
+		VM_WARN_ON_ONCE(size == PMD_SIZE && hugetlb_pmd_shared(dst_pte));
 		_dst_pte = make_pte_marker(PTE_MARKER_POISONED);
 		set_huge_pte_at(dst_mm, dst_addr, dst_pte, _dst_pte, size);
 
-- 
2.20.1