linux-kernel - Re: isolate_lru

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 15 Dec 2015 17:59:43 +0100
From:	Michal Hocko <mhocko@...nel.org>
To:	"Kirill A. Shutemov" <kirill@...temov.name>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Minchan Kim <minchan@...nel.org>, linux-mm@...ck.org,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: isolate_lru_page on !head pages

On Tue 15-12-15 14:03:18, Kirill A. Shutemov wrote:
> On Tue, Dec 15, 2015 at 09:52:33AM +0100, Michal Hocko wrote:
> > On Mon 14-12-15 14:04:56, Kirill A. Shutemov wrote:
> > > On Wed, Dec 09, 2015 at 02:02:05PM +0100, Michal Hocko wrote:
> > > > Hi Kirill,
> > > 
> > > [ sorry for late reply, just back from vacation. ]
> > > 
> > > > while looking at the issue reported by Minchan [1] I have noticed that
> > > > there is nothing to prevent from "isolating" a tail page from LRU because
> > > > isolate_lru_page checks PageLRU which is
> > > > PAGEFLAG(LRU, lru, PF_HEAD)
> > > > so it is checked on the head page rather than the given page directly
> > > > but the rest of the operation is done on the given (tail) page.
> > > 
> > > Looks like most (all?) callers already exclude PTE-mapped THP already one
> > > way or another.
> > 
> > I can see e.g. do_move_page_to_node_array not doing a similar thing. It
> > isolates and then migrates potentially a tail page.
> 
> No, it doesn't. follow_page(FOLL_SPLIT) would split THP pages.

Ahh, I thought it would split the pmd but this path splits the page
directly.
 
> > I haven't looked closer whether there is other hand break on the way
> > though. The point I was trying to make is that this is really _subtle_.
> > We are changing something else than we operate later on.
> > 
> > > Probably, VM_BUG_ON_PAGE(PageTail(page), page) in isolate_lru_page() would
> > > be appropriate.
> > > 
> > > > This is really subtle because this expects that every caller of this
> > > > function checks for the tail page otherwise we would clobber statistics
> > > > and who knows what else (I haven't checked that in detail) as the page
> > > > cannot be on the LRU list and the operation makes sense only on the head
> > > > page.
> > > > 
> > > > Would it make more sense to make PageLRU PF_ANY? That would return
> > > > false for PageLRU on any tail page and so it would be ignored by
> > > > isolate_lru_page.
> > > 
> > > I don't think this is right way to go. What we put on LRU is compound
> > > page, not 4k subpages. PageLRU() should return true if the compound page
> > > is on LRU regardless if you ask for head or tail page.
> > 
> > Hmm, but then we should operate on the head page because that is what
> > PageLRU operated on, no?
> 
> head page is what linked into LRU, but not nessesary the way we obtain the
> page to check. If we check PageLRU(pte_page(*pte)) it should produce the
> right result.

I am not following you here. Any pfn walk could get to a tail page and
if we happen to do e.g. isolate_lru_page we have to remember that we
should always treat compound page differently. This is subtle. Anyway I
am far from understading other parts of the refcount rework so I will
spend time studying the code as soon as the time permits. In the
meantime I agree that VM_BUG_ON_PAGE(PageTail(page), page) would be
useful to catch all the fallouts.
-- 
Michal Hocko
SUSE Labs
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/