linux-kernel - [PATCH mmotm] memcg: Ignore partial THP when moving task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1449594789-15866-1-git-send-email-mhocko@kernel.org>
Date:	Tue,  8 Dec 2015 18:13:09 +0100
From:	Michal Hocko <mhocko@...nel.org>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Johannes Weiner <hannes@...xchg.org>,
	Minchan Kim <minchan@...nel.org>,
	"Kirill A. Shutemov" <kirill@...temov.name>,
	Vladimir Davydov <vdavydov@...allels.com>,
	<linux-mm@...ck.org>, LKML <linux-kernel@...r.kernel.org>,
	Michal Hocko <mhocko@...e.com>
Subject: [PATCH mmotm] memcg: Ignore partial THP when moving task

From: Michal Hocko <mhocko@...e.com>

After "mm: rework mapcount accounting to enable 4k mapping of THPs"
it is possible to have a partial THP accessible via ptes. Memcg task
migration code is not prepared for this situation and uncharges the tail
page from the original memcg while the original THP is still charged via
the head page which is not mapped to the moved task. The page counter
of the origin memcg will underflow when the whole THP is uncharged later
on and lead to:
WARNING: CPU: 0 PID: 1340 at mm/page_counter.c:26 page_counter_cancel+0x34/0x40()
reported by Minchan Kim.

This patch prevents from the underflow by skipping any partial THP pages
in mem_cgroup_move_charge_pte_range. PageTransCompound is checked when
we do pte walk. This means that a process might leave a partial THP
behind in the original memcg if there is no other process mapping it via
pmd but this is considered acceptable because it shouldn't happen often
and this is not considered a memory leak because the original THP is
still accessible and reclaimable. Moreover the task migration has always
been racy and never guaranteed to move all pages.

Reported-by: Minchan Kim <minchan@...nel.org>
Acked-by: Johannes Weiner <hannes@...xchg.org>
Signed-off-by: Michal Hocko <mhocko@...e.com>
---

Hi,
this is a patch tested by Minchan in the original thread [1]. I have
only replaced PageCompound with PageTransCompound because other similar
fixes in mmotm used this one. The underlying implementation is the same.
Johannes, I have kept your a-b but let me know if you are not OK with the
changelog.

This is mmotm only material. It can be merged into the page which
has introduced the issue but maybe it is worth having on its own for
documentation purposes. I will leave the decision to you Andrew.

[1] http://lkml.kernel.org/r/20151201133455.GB27574@bbox

 mm/memcontrol.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 79a29d564bff..143c933f0b81 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4895,6 +4895,14 @@ static int mem_cgroup_move_charge_pte_range(pmd_t *pmd,
 		switch (get_mctgt_type(vma, addr, ptent, &target)) {
 		case MC_TARGET_PAGE:
 			page = target.page;
+			/*
+			 * We can have a part of the split pmd here. Moving it
+			 * can be done but it would be too convoluted so simply
+			 * ignore such a partial THP and keep it in original
+			 * memcg. There should be somebody mapping the head.
+			 */
+			if (PageCompound(page))
+				goto put;
 			if (isolate_lru_page(page))
 				goto put;
 			if (!mem_cgroup_move_account(page, false,
-- 
2.6.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/