FAILED: patch "[PATCH] xen/gntdev: Accommodate VMA splitting" failed to apply to 4.19-stable tree

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

Possible dependencies:

5c13a4a0291b ("xen/gntdev: Accommodate VMA splitting")
dbe97cff7dd9 ("xen/gntdev: Avoid blocking in unmap_grant_pages()") ce2f46f3531a ("xen/gntdev: fix unmap notification order")
f28347cc6639 ("Xen/gntdev: don't ignore kernel unmapping error") 30dcc56bba91 ("xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests") 970655aa9b42 ("xen/gntdev: fix gntdev_mmap() error exit path") bce21a2b48ed ("Xen/gnttab: introduce common INVALID_GRANT_{HANDLE,REF}") 36caa3fedf06 ("Xen/gntdev: don't needlessly allocate k{,un}map_ops[]") 8310b77b48c5 ("Xen/gnttab: handle p2m update errors on a per-slot basis") 36bf1dfb8b26 ("xen/arm: don't ignore return errors from set_phys_to_machine") ebee0eab0859 ("Xen/gntdev: correct error checking in gntdev_map_grant_pages()") dbe5283605b3 ("Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages()") 0102e4efda76 ("xen: Use evtchn_type_t as a type for event channels") 9293724192a7 ("xen/gntdev: Do not use mm notifiers with autotranslating guests") b3f7931f5c61 ("xen/gntdev: switch from kcalloc() to kvcalloc()") 3b06ac6707c1 ("xen/gntdev: replace global limit of mapped pages by limit per call") d3eeb1d77c5d ("xen/gntdev: use mmu_interval_notifier_insert") ee7f5225dc3c ("xen: Stop abusing DT of_dma_configure API")
bce5963bcb4f ("xen/events: fix binding user event channels to cpus") 8b1e0f81fb6f ("mm/pgtable: drop pgtable_t variable from pte_fn_t functions")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 5c13a4a0291b30191eff9ead8d010e1ca43a4d0c Mon Sep 17 00:00:00 2001
From: "M. Vefa Bicakci" <[email protected]>
Date: Sun, 2 Oct 2022 18:20:06 -0400
Subject: [PATCH] xen/gntdev: Accommodate VMA splitting

Prior to this commit, the gntdev driver code did not handle the following scenario correctly with paravirtualized (PV) Xen domains:

* User process sets up a gntdev mapping composed of two grant mappings (i.e., two pages shared by another Xen domain).
* User process munmap()s one of the pages.
* User process munmap()s the remaining page.
* User process exits.

In the scenario above, the user process would cause the kernel to log the following messages in dmesg for the first munmap(), and the second munmap() call would result in similar log messages:

  BUG: Bad page map in process doublemap.test  pte:... pmd:...
  page:0000000057c97bff refcount:1 mapcount:-1 \
    mapping:0000000000000000 index:0x0 pfn:...
  ...
  page dumped because: bad pte
  ...
  file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0
  ...
  Call Trace:
   <TASK>
   dump_stack_lvl+0x46/0x5e
   print_bad_pte.cold+0x66/0xb6
   unmap_page_range+0x7e5/0xdc0
   unmap_vmas+0x78/0xf0
   unmap_region+0xa8/0x110
   __do_munmap+0x1ea/0x4e0
   __vm_munmap+0x75/0x120
   __x64_sys_munmap+0x28/0x40
   do_syscall_64+0x38/0x90
   entry_SYSCALL_64_after_hwframe+0x61/0xcb
   ...

For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG) would print out the following and trigger a general protection fault in the affected Xen PV domain:

(XEN) d0v... Attempt to implicitly unmap d0's grant PTE ... (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...

As of this writing, gntdev_grant_map structure's vma field (referred to as map->vma below) is mainly used for checking the start and end addresses of mappings. However, with split VMAs, these may change, and there could be more than one VMA associated with a gntdev mapping. Hence, remove the use of map->vma and rely on map->pages_vm_start for the original start address and on (map->count << PAGE_SHIFT) for the original mapping size. Let the invalidate() and find_special_page() hooks use these.

Also, given that there can be multiple VMAs associated with a gntdev mapping, move the "mmu_interval_notifier_remove(&map->notifier)" call to the end of gntdev_put_map, so that the MMU notifier is only removed after the closing of the last remaining VMA.

Finally, use an atomic to prevent inadvertent gntdev mapping re-use, instead of using the map->live_grants atomic counter and/or the map->vma pointer (the latter of which is now removed). This prevents the userspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the same address range as a previously set up gntdev mapping. This scenario can be summarized with the following call-trace, which was valid prior to this commit:

mmap
gntdev_mmap
mmap (repeat mmap with MAP_FIXED over the same address range)
gntdev_invalidate
unmap_grant_pages (sets 'being_removed' entries to true)
gnttab_unmap_refs_async
unmap_single_vma
gntdev_mmap (maps the shared pages again)
munmap
gntdev_invalidate
unmap_grant_pages
(no-op because 'being_removed' entries are true)
unmap_single_vma (For PV domains, Xen reports that a granted page
is being unmapped and triggers a general protection fault in the affected domain, if Xen was built with CONFIG_DEBUG)

The fix for this last scenario could be worth its own commit, but we opted for a single commit, because removing the gntdev_grant_map structure's vma field requires guarding the entry to gntdev_mmap(), and the live_grants atomic counter is not sufficient on its own to prevent the mmap() over a pre-existing mapping.

index 40ef379c28ab..9c286b2a1900 100644
@@ -44,9 +44,10 @@ struct gntdev_unmap_notify {
 };
 
 struct gntdev_grant_map {
+	atomic_t in_use;
 	struct mmu_interval_notifier notifier;
+	bool notifier_init;
 	struct list_head next;
-	struct vm_area_struct *vma;
 	int index;
 	int count;
 	int flags;