linux-kernel - Re: isolate_lru

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 14 Dec 2015 14:04:56 +0200
From:	"Kirill A. Shutemov" <kirill@...temov.name>
To:	Michal Hocko <mhocko@...nel.org>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Minchan Kim <minchan@...nel.org>, linux-mm@...ck.org,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: isolate_lru_page on !head pages

On Wed, Dec 09, 2015 at 02:02:05PM +0100, Michal Hocko wrote:
> Hi Kirill,

[ sorry for late reply, just back from vacation. ]

> while looking at the issue reported by Minchan [1] I have noticed that
> there is nothing to prevent from "isolating" a tail page from LRU because
> isolate_lru_page checks PageLRU which is
> PAGEFLAG(LRU, lru, PF_HEAD)
> so it is checked on the head page rather than the given page directly
> but the rest of the operation is done on the given (tail) page.

Looks like most (all?) callers already exclude PTE-mapped THP already one
way or another.
Probably, VM_BUG_ON_PAGE(PageTail(page), page) in isolate_lru_page() would
be appropriate.

> This is really subtle because this expects that every caller of this
> function checks for the tail page otherwise we would clobber statistics
> and who knows what else (I haven't checked that in detail) as the page
> cannot be on the LRU list and the operation makes sense only on the head
> page.
> 
> Would it make more sense to make PageLRU PF_ANY? That would return
> false for PageLRU on any tail page and so it would be ignored by
> isolate_lru_page.

I don't think this is right way to go. What we put on LRU is compound
page, not 4k subpages. PageLRU() should return true if the compound page
is on LRU regardless if you ask for head or tail page.

False-negatives PageLRU() can be as bad as bug Minchan reported, but
perhaps more silent.

> I haven't checked other flags but there might be a similar situation. I
> am wondering whether it is really a good idea to perform a flag check on
> a different page then the operation which depends on the result of the
> test in general. It sounds like a maintenance horror to me.
> 
> [1] http://lkml.kernel.org/r/20151201133455.GB27574@bbox
-- 
 Kirill A. Shutemov
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/