linux-kernel - Re: [RFC -mm] mm, userfaultfd, THP: Avoid waiting when PMD under THP migration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 06 Nov 2017 10:53:48 -0500
From:   "Zi Yan" <zi.yan@...rutgers.edu>
To:     "huang ying" <huang.ying.caritas@...il.com>
Cc:     "Huang, Ying" <ying.huang@...el.com>,
        "Naoya Horiguchi" <n-horiguchi@...jp.nec.com>, linux-mm@...ck.org,
        LKML <linux-kernel@...r.kernel.org>,
        "Andrea Arcangeli" <aarcange@...hat.com>,
        "Mike Kravetz" <mike.kravetz@...cle.com>,
        "Mike Rapoport" <rppt@...ux.vnet.ibm.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        "Alexander Viro" <viro@...iv.linux.org.uk>
Subject: Re: [RFC -mm] mm, userfaultfd, THP: Avoid waiting when PMD under THP
 migration

On 4 Nov 2017, at 23:01, huang ying wrote:

> On Fri, Nov 3, 2017 at 11:00 PM, Zi Yan <zi.yan@...rutgers.edu> wrote:
>> On 3 Nov 2017, at 3:52, Huang, Ying wrote:
>>
>>> From: Huang Ying <ying.huang@...el.com>
>>>
>>> If THP migration is enabled, the following situation is possible,
>>>
>>> - A THP is mapped at source address
>>> - Migration is started to move the THP to another node
>>> - Page fault occurs
>>> - The PMD (migration entry) is copied to the destination address in 
>>> mremap
>>>
>>
>> You mean the page fault path follows the source address and sees 
>> pmd_none() now
>> because mremap() clears it and remaps the page with dest address.
>> Otherwise, it seems not possible to get into handle_userfault(), 
>> since it is called in
>> pmd_none() branch inside do_huge_pmd_anonymous_page().
>>
>>
>>> That is, it is possible for handle_userfault() encounter a PMD entry
>>> which has been handled but !pmd_present().  In the current
>>> implementation, we will wait for such PMD entries, which may cause
>>> unnecessary waiting, and potential soft lockup.
>>
>> handle_userfault() should only see pmd_none() in the situation you 
>> describe,
>> whereas !pmd_present() (migration entry case) should lead to
>> pmd_migration_entry_wait().
>
> Yes.  This is my understanding of the source code too.  And I
> described it in the original patch description too.  I just want to
> make sure whether it is possible that !pmd_none() and !pmd_present()
> for a PMD in userfaultfd_must_wait().  And, whether it is possible for
> us to implement PMD mapping copying in UFFDIO_COPY in the future?
>

Thanks for clarifying it. We both agree that !pmd_present(), which means
PMD migration entry, does not get into userfaultfd_must_wait(),
then there seems to be no issue with current code yet.

However, the if (!pmd_present(_pmd)) in userfaultfd_must_wait() does not 
match
the exact condition. How about the patch below? It can catch pmd 
migration entries,
which are only possible in x86_64 at the moment.

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 1c713fd5b3e6..dda25444a6ee 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -294,9 +294,11 @@ static inline bool userfaultfd_must_wait(struct 
userfaultfd_ctx *ctx,
          * pmd_trans_unstable) of the pmd.
          */
         _pmd = READ_ONCE(*pmd);
-       if (!pmd_present(_pmd))
+       if (pmd_none(_pmd))
                 goto out;

+       VM_BUG_ON(thp_migration_supported() && 
is_pmd_migration_entry(_pmd));
+
         ret = false;
         if (pmd_trans_huge(_pmd))
                 goto out;



—
Best Regards,
Yan Zi