Skip to contentSkip to conversation

mm/memfd_luo: report error when restoring a folio fails mid-loop

PATCH Applied David Carlier 3 participants 3 messages Apr 15 – Apr 28

Subsystems (2)
Memory management Live update
lore
Share & tools
lore

David Carlier

author
#0 lore raw

PATCH 1/1 mm/memfd_luo: report error when restoring a folio fails mid-loop

memfd_luo_retrieve_folios() initialises err to -EIO, but the per-iteration calls to mem_cgroup_charge(), shmem_add_to_page_cache() and shmem_inode_acct_blocks() reuse and overwrite err. Once any iteration completes successfully, err becomes zero.

If a later iteration's kho_restore_folio() returns NULL, the failure path jumps to put_folios without resetting err, so the function returns 0. The caller memfd_luo_retrieve() then takes the success path, sets args->file and reports the restore as successful, leaving userspace with a partially populated memfd and no indication that anything went wrong.

Set err to -EIO in the kho_restore_folio() failure branch so the error is propagated to the caller.

Signed-off-by David Carlier <[email protected]>
---
 mm/memfd_luo.c | 1 +
 1 file changed, 1 insertion(+)
mm/memfd_luo.c +1 -0
index b02b503c750d..35d1247281e0 100644
@@ -427,6 +427,7 @@ static int memfd_luo_retrieve_folios(struct file *file,
 		if (!folio) {
 			pr_err("Unable to restore folio at physical address: %llx\n",
 			       phys);
+			err = -EIO;
 			goto put_folios;
 		}
 		index = pfolio->index;
Signature · 1 line
2.53.0
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 11 lines · David Carlier

memfd_luo_retrieve_folios() initialises err to -EIO, but the per-iteration calls to mem_cgroup_charge(), shmem_add_to_page_cache() and shmem_inode_acct_blocks() reuse and overwrite err. Once any iteration completes successfully, err becomes zero.

If a later iteration's kho_restore_folio() returns NULL, the failure path jumps to put_folios without resetting err, so the function returns 0. The caller memfd_luo_retrieve() then takes the success path, sets args->file and reports the restore as successful, leaving userspace with a partially populated memfd and no indication that anything went wrong.

Quoted 4 lines

Set err to -EIO in the kho_restore_folio() failure branch so the error is propagated to the caller.

Signed-off-by David Carlier <[email protected]>
Reviewed-by Pratyush Yadav <[email protected]>

Please add these when applying:

Cc [email protected]
Fixes b3749f174d68 ("mm: memfd_luo: allow preserving memfd")

[...]

Signature · 2 lines
Regards,
Pratyush Yadav
maintainer Applied
#2 lore raw
In reply to David Carlier

From: Mike Rapoport (Microsoft) <[email protected]>

Quoted 5 lines · David Carlier

memfd_luo_retrieve_folios() initialises err to -EIO, but the per-iteration calls to mem_cgroup_charge(), shmem_add_to_page_cache() and shmem_inode_acct_blocks() reuse and overwrite err. Once any iteration completes successfully, err becomes zero.

Quoted 7 lines

If a later iteration's kho_restore_folio() returns NULL, the failure path jumps to put_folios without resetting err, so the function returns 0. The caller memfd_luo_retrieve() then takes the success path, sets args->file and reports the restore as successful, leaving userspace with a partially populated memfd and no indication that anything went wrong.

[...]

Applied to fixes branch of liveupdate/linux.git tree, thanks!

[1/1] mm/memfd_luo: report error when restoring a folio fails mid-loop

      commit: 0fb1daf0b78d0e23b63b6b65de56d4a3fd83bc14

tree: https://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux
branch: fixes

--
Sincerely yours,
Mike.