From: "Kiryl Shutsemau (Meta)" <[email protected]>
PAGEMAP_SCAN reports an unpopulated pte on a uffd-wp VMA differently
depending on which path serves the request. The PAGE_IS_WRITTEN fast
path in pagemap_scan_pmd_entry() treats a pte_none (no uffd-wp marker)
as written and, under PM_SCAN_WP_MATCHING, arms a marker. The generic
path does not: pagemap_page_category() returns 0 for pte_none, so a
request that cannot use the fast path (extra category bit,
category_anyof_mask or category_inverted) reports the same pte as clean
and skips arming it.
So a range that was populated and then MADV_DONTNEED'd reads as written
via one mask and clean via another, and in the latter case is not
re-armed for the next round -- an incremental-dump consumer (e.g. CRIU)
using a richer mask drops the zapped range and stops tracking writes to
it.
Return PAGE_IS_WRITTEN for a pte_none on a uffd-wp VMA, mirroring the
present and swap branches just below which already report it whenever the
entry is not write-protected.
Add a pagemap_ioctl selftest that asserts the two paths agree over a
MADV_DONTNEED'd range.
Fixes: 12f6b01a0bcb ("fs/proc/task_mmu: add fast paths to get/clear
PAGE_IS_WRITTEN flag")
Cc: Muhammad Usama Anjum <[email protected]>
Cc: Peter Xu <[email protected]>
Cc: [email protected]
Signed-off-by: Kiryl Shutsemau <[email protected]>
Assisted-by: Claude:claude-fable-5
---
fs/proc/task_mmu.c | 14 +++++-
tools/testing/selftests/mm/pagemap_ioctl.c | 55 +++++++++++++++++++++-
2 files changed, 67 insertions(+), 2 deletions(-)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index d32408f7cd5e..a5f5d2e04257 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -2432,8 +2432,20 @@ static unsigned long pagemap_page_category(struct
pagemap_scan_private *p,
{
unsigned long categories;
- if (pte_none(pte))
+ if (pte_none(pte)) {
+ /*
+ * An unpopulated pte carries no uffd-wp marker, so like any
+ * other entry that is not write-protected it reads as written
+ * on a uffd-wp VMA. This matches the PAGE_IS_WRITTEN fast path
+ * in pagemap_scan_pmd_entry(); without it a scan forced onto
+ * this generic path (extra category bits, anyof or inverted
+ * masks) would report the same pte differently and, under
+ * PM_SCAN_WP_MATCHING, skip arming its marker.
+ */
+ if (userfaultfd_wp(vma))
+ return PAGE_IS_WRITTEN;
return 0;
+ }
if (pte_present(pte)) {
struct page *page;
diff --git a/tools/testing/selftests/mm/pagemap_ioctl.c
b/tools/testing/selftests/mm/pagemap_ioctl.c
index 762306177ad8..78fa2d1e3719 100644
--- a/tools/testing/selftests/mm/pagemap_ioctl.c
+++ b/tools/testing/selftests/mm/pagemap_ioctl.c
@@ -1051,6 +1051,56 @@ static void test_simple(void)
ksft_test_result(i == TEST_ITERATIONS, "Test %s\n", __func__);
}
+/*
+ * A range that was populated and then MADV_DONTNEED'd is genuine pte_none
+ * with no uffd-wp marker. Such a pte must read the same regardless of which
+ * PAGEMAP_SCAN path serves the request: the PAGE_IS_WRITTEN fast path and the
+ * generic path (reached e.g. via category_anyof_mask) must agree.
+ */
+static void unpopulated_scan_test(void)
+{
+ int npages = 16, i;
+ long mem_size = npages * page_size;
+ struct page_region regions[16];
+ long fast = 0, slow = 0, ret;
+ char *mem;
+
+ mem = mmap(NULL, mem_size, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (mem == MAP_FAILED)
+ ksft_exit_fail_msg("%s mmap failed\n", __func__);
+
+ wp_init(mem, mem_size);
+
+ /* Populate, then drop: the ptes become pte_none without a marker. */
+ memset(mem, 1, mem_size);
+ if (madvise(mem, mem_size, MADV_DONTNEED))
+ ksft_exit_fail_msg("%s MADV_DONTNEED failed\n", __func__);
+
+ /* Fast path: category_mask == return_mask == PAGE_IS_WRITTEN. */
+ ret = pagemap_ioctl(mem, mem_size, regions, npages, 0, 0,
+ PAGE_IS_WRITTEN, 0, 0, PAGE_IS_WRITTEN);
+ if (ret < 0)
+ ksft_exit_fail_msg("%s fast scan failed\n", __func__);
+ for (i = 0; i < ret; i++)
+ fast += LEN(regions[i]);
+
+ /* Generic path: same query expressed via category_anyof_mask. */
+ ret = pagemap_ioctl(mem, mem_size, regions, npages, 0, 0,
+ 0, PAGE_IS_WRITTEN, 0, PAGE_IS_WRITTEN);
+ if (ret < 0)
+ ksft_exit_fail_msg("%s generic scan failed\n", __func__);
+ for (i = 0; i < ret; i++)
+ slow += LEN(regions[i]);
+
+ ksft_test_result(fast == slow,
+ "%s unpopulated ptes agree across scan paths (%ld vs
%ld)\n",
+ __func__, fast, slow);
+
+ wp_free(mem, mem_size);
+ munmap(mem, mem_size);
+}
+
int sanity_tests(void)
{
unsigned long long mem_size, vec_size;
@@ -1559,7 +1609,7 @@ int main(int __attribute__((unused)) argc, char *argv[])
if (!hugetlb_setup_default(4))
ksft_print_msg("HugeTLB test will be skipped\n");
- ksft_set_plan(117);
+ ksft_set_plan(118);
page_size = getpagesize();
hpage_size = read_pmd_pagesize();
@@ -1737,6 +1787,9 @@ int main(int __attribute__((unused)) argc, char *argv[])
/* 17. ZEROPFN tests */
zeropfn_tests();
+ /* 18. Unpopulated pte scan-path consistency */
+ unpopulated_scan_test();
+
close(pagemap_fd);
ksft_finished();
}
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
--
2.54.0
