linux-kernel - Re: [BUG] mm: thp: hugepage_vma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.02.1401211519530.15306@chino.kir.corp.google.com>
Date:	Tue, 21 Jan 2014 15:24:08 -0800 (PST)
From:	David Rientjes <rientjes@...gle.com>
To:	Alex Thorlton <athorlton@....com>
cc:	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Mel Gorman <mgorman@...e.de>, Rik van Riel <riel@...hat.com>,
	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>, linux-mm@...ck.org
Subject: Re: [BUG] mm: thp: hugepage_vma_check has a blind spot

On Tue, 21 Jan 2014, Alex Thorlton wrote:

> hugepage_vma_check is called during khugepaged_scan_mm_slot to ensure
> that khugepaged doesn't try to allocate THPs in vmas where they are
> disallowed, either due to THPs being disabled system-wide, or through
> MADV_NOHUGEPAGE.
> 
> The logic that hugepage_vma_check uses doesn't seem to cover all cases,
> in my opinion.  Looking at the original code:
> 
>        if ((!(vma->vm_flags & VM_HUGEPAGE) && !khugepaged_always()) ||
> 	   (vma->vm_flags & VM_NOHUGEPAGE))
> 
> We can see that it's possible to have THP disabled system-wide, but still
> receive THPs in this vma.  It seems that it's assumed that just because
> khugepaged_always == false, TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG must be
> set, which is not the case.  We could have VM_HUGEPAGE set, but have THP
> set to "never" system-wide, in which case, the condition presented in the
> if will evaluate to false, and (provided the other checks pass) we can
> end up giving out a THP even though the behavior is set to "never."
> 

You should be able to add a

	BUG_ON(current != khugepaged_thread);

here since khugepaged is supposed to be the only caller to the function.

> While we do properly check these flags in khugepaged_has_work, it looks
> like it's possible to sleep after we check khugepaged_hask_work, but
> before hugepage_vma_check, during which time, hugepages could have been
> disabled system-wide, in which case, we could hand out THPs when we
> shouldn't be.
> 

You're talking about when thp is set to "never" and before khugepaged has 
stopped, correct?

That doesn't seem like a bug to me or anything that needs to be fixed, the 
sysfs knob could be switched even after hugepage_vma_check() is called and 
before a hugepage is actually collapsed so you have the same race.

The only thing that's guaranteed is that, upon writing "never" to 
/sys/kernel/mm/transparent_hugepage/enabled, no more thp memory will be 
collapsed after khugepaged has stopped.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/