lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <alpine.LSU.2.11.1510261826190.10825@eggly.anvils> Date: Mon, 26 Oct 2015 18:28:13 -0700 (PDT) From: Hugh Dickins <hughd@...gle.com> To: Minchan Kim <minchan@...nel.org> cc: Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org, linux-kernel@...r.kernel.org, Hugh Dickins <hughd@...gle.com>, Rik van Riel <riel@...hat.com>, Mel Gorman <mgorman@...e.de>, Michal Hocko <mhocko@...e.cz>, Johannes Weiner <hannes@...xchg.org>, "Kirill A. Shutemov" <kirill@...temov.name>, Vlastimil Babka <vbabka@...e.cz> Subject: Re: [PATCH 3/5] mm: clear PG_dirty to mark page freeable On Mon, 19 Oct 2015, Minchan Kim wrote: > Basically, MADV_FREE relies on dirty bit in page table entry > to decide whether VM allows to discard the page or not. > IOW, if page table entry includes marked dirty bit, VM shouldn't > discard the page. > > However, as a example, if swap-in by read fault happens, > page table entry doesn't have dirty bit so MADV_FREE could discard > the page wrongly. > > For avoiding the problem, MADV_FREE did more checks with PageDirty > and PageSwapCache. It worked out because swapped-in page lives on > swap cache and since it is evicted from the swap cache, the page has > PG_dirty flag. So both page flags check effectively prevent > wrong discarding by MADV_FREE. > > However, a problem in above logic is that swapped-in page has > PG_dirty still after they are removed from swap cache so VM cannot > consider the page as freeable any more even if madvise_free is > called in future. > > Look at below example for detail. > > ptr = malloc(); > memset(ptr); > .. > .. > .. heavy memory pressure so all of pages are swapped out > .. > .. > var = *ptr; -> a page swapped-in and could be removed from > swapcache. Then, page table doesn't mark > dirty bit and page descriptor includes PG_dirty > .. > .. > madvise_free(ptr); -> It doesn't clear PG_dirty of the page. > .. > .. > .. > .. heavy memory pressure again. > .. In this time, VM cannot discard the page because the page > .. has *PG_dirty* > > To solve the problem, this patch clears PG_dirty if only the page > is owned exclusively by current process when madvise is called > because PG_dirty represents ptes's dirtiness in several processes > so we could clear it only if we own it exclusively. > > Cc: Hugh Dickins <hughd@...gle.com> > Signed-off-by: Minchan Kim <minchan@...nel.org> Acked-by: Hugh Dickins <hughd@...gle.com> (and patches 1/5 and 2/5 too if you like) > --- > mm/madvise.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/mm/madvise.c b/mm/madvise.c > index fdfb14a78c60..5db546431285 100644 > --- a/mm/madvise.c > +++ b/mm/madvise.c > @@ -312,11 +312,19 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr, > if (!page) > continue; > > - if (PageSwapCache(page)) { > + if (PageSwapCache(page) || PageDirty(page)) { > if (!trylock_page(page)) > continue; > + /* > + * If page is shared with others, we couldn't clear > + * PG_dirty of the page. > + */ > + if (page_count(page) != 1 + !!PageSwapCache(page)) { > + unlock_page(page); > + continue; > + } > > - if (!try_to_free_swap(page)) { > + if (PageSwapCache(page) && !try_to_free_swap(page)) { > unlock_page(page); > continue; > } > -- > 1.9.1 > > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists