On Sun, Nov 24, 2019 at 04:05:16PM -0800, John Hubbard wrote:
I looked into this, and I believe that the problem is in gup.c. There appears to have been an oversight, in commit 817be129e6f2 ("mm: validate get_user_pages_fast flags"), in filtering out FOLL_FORCE. There is nothing in the _fast() implementation that requires that we avoid writing to the pages.
I think it is too late to be doing these kinds of changes, I will revert the patch and this will miss this merge window.
Jason
From ec6cb45292d21d1af9b9d95997b8cf204bbe854c Mon Sep 17 00:00:00 2001
From: Jason Gunthorpe jgg@mellanox.com Date: Sun, 24 Nov 2019 20:47:59 -0400 Subject: [PATCH] Revert "IB/umem: use get_user_pages_fast() to pin DMA pages"
This reverts commit c9a7a2ed837c563f9f89743a6db732591cb4035b.
This was merged before enough testing was done, and it triggers a WARN_ON() in get_user_pages_fast():
WARNING: CPU: 1 PID: 2557 at mm/gup.c:2404 get_user_pages_fast+0x115/0x180 Call Trace: ib_umem_get+0x298/0x550 [ib_uverbs] mlx5_ib_db_map_user+0xad/0x130 [mlx5_ib] mlx5_ib_create_cq+0x1e8/0xaa0 [mlx5_ib] create_cq+0x1c8/0x2d0 [ib_uverbs] ib_uverbs_create_cq+0x70/0xa0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xc2/0xf0 [ib_uverbs] ib_uverbs_cmd_verbs.isra.6+0x5be/0xbe0 [ib_uverbs] ? uverbs_disassociate_api+0xd0/0xd0 [ib_uverbs] ? kvm_clock_get_cycles+0xd/0x10 ? kmem_cache_alloc+0x176/0x1c0 ? filemap_map_pages+0x18c/0x350 ib_uverbs_ioctl+0xc0/0x120 [ib_uverbs] do_vfs_ioctl+0xa1/0x610 ksys_ioctl+0x70/0x80 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x42/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9
2404 if (WARN_ON_ONCE(gup_flags & ~(FOLL_WRITE | FOLL_LONGTERM))) 2405 return -EINVAL;
While we think this WARN_ON is probably bogus, resolving this will have to wait.
Signed-off-by: Jason Gunthorpe jgg@mellanox.com --- drivers/infiniband/core/umem.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c index 214e87aa609d6e..7a3b99597eada1 100644 --- a/drivers/infiniband/core/umem.c +++ b/drivers/infiniband/core/umem.c @@ -266,13 +266,16 @@ struct ib_umem *ib_umem_get(struct ib_udata *udata, unsigned long addr, sg = umem->sg_head.sgl;
while (npages) { - ret = get_user_pages_fast(cur_base, - min_t(unsigned long, npages, - PAGE_SIZE / - sizeof(struct page *)), - gup_flags | FOLL_LONGTERM, page_list); - if (ret < 0) + down_read(&mm->mmap_sem); + ret = get_user_pages(cur_base, + min_t(unsigned long, npages, + PAGE_SIZE / sizeof (struct page *)), + gup_flags | FOLL_LONGTERM, + page_list, NULL); + if (ret < 0) { + up_read(&mm->mmap_sem); goto umem_release; + }
cur_base += ret * PAGE_SIZE; npages -= ret; @@ -280,6 +283,8 @@ struct ib_umem *ib_umem_get(struct ib_udata *udata, unsigned long addr, sg = ib_umem_add_sg_table(sg, page_list, ret, dma_get_max_seg_size(context->device->dma_device), &umem->sg_nents); + + up_read(&mm->mmap_sem); }
sg_mark_end(sg);