linux-kernel - Re: [BUG] mm: thp: hugepage_vma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 22 Jan 2014 12:14:42 -0600
From:	Alex Thorlton <athorlton@....com>
To:	David Rientjes <rientjes@...gle.com>
Cc:	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Mel Gorman <mgorman@...e.de>, Rik van Riel <riel@...hat.com>,
	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>, linux-mm@...ck.org
Subject: Re: [BUG] mm: thp: hugepage_vma_check has a blind spot

On Tue, Jan 21, 2014 at 03:24:08PM -0800, David Rientjes wrote:
> On Tue, 21 Jan 2014, Alex Thorlton wrote:
> 
> > hugepage_vma_check is called during khugepaged_scan_mm_slot to ensure
> > that khugepaged doesn't try to allocate THPs in vmas where they are
> > disallowed, either due to THPs being disabled system-wide, or through
> > MADV_NOHUGEPAGE.
> > 
> > The logic that hugepage_vma_check uses doesn't seem to cover all cases,
> > in my opinion.  Looking at the original code:
> > 
> >        if ((!(vma->vm_flags & VM_HUGEPAGE) && !khugepaged_always()) ||
> > 	   (vma->vm_flags & VM_NOHUGEPAGE))
> > 
> > We can see that it's possible to have THP disabled system-wide, but still
> > receive THPs in this vma.  It seems that it's assumed that just because
> > khugepaged_always == false, TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG must be
> > set, which is not the case.  We could have VM_HUGEPAGE set, but have THP
> > set to "never" system-wide, in which case, the condition presented in the
> > if will evaluate to false, and (provided the other checks pass) we can
> > end up giving out a THP even though the behavior is set to "never."
> > 
> 
> You should be able to add a
> 
> 	BUG_ON(current != khugepaged_thread);
> 
> here since khugepaged is supposed to be the only caller to the function.
> 
> > While we do properly check these flags in khugepaged_has_work, it looks
> > like it's possible to sleep after we check khugepaged_hask_work, but
> > before hugepage_vma_check, during which time, hugepages could have been
> > disabled system-wide, in which case, we could hand out THPs when we
> > shouldn't be.
> > 
> 
> You're talking about when thp is set to "never" and before khugepaged has 
> stopped, correct?

Yes, that's correct.

> That doesn't seem like a bug to me or anything that needs to be fixed, the 
> sysfs knob could be switched even after hugepage_vma_check() is called and 
> before a hugepage is actually collapsed so you have the same race.
> 
> The only thing that's guaranteed is that, upon writing "never" to 
> /sys/kernel/mm/transparent_hugepage/enabled, no more thp memory will be 
> collapsed after khugepaged has stopped.

That makes sense, I wasn't aware that that's the expected behavior here.
I suppose this isn't something that needs to be changed, in that case.
I needed the logic broken out a bit more explicitly (madvise/never case
need to be handled separately) for a patch that I'm working on - that's
when this caught my attention.  Good to know that a change to the
system-wide switch shouldn't affect khugepaged if it's already running.
I would've screwed up that behavior with my patch :)

Thanks, David!

- Alex
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/