linux-kernel - Re: isolate_lru

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151215120318.GA11497@node.shutemov.name>
Date:	Tue, 15 Dec 2015 14:03:18 +0200
From:	"Kirill A. Shutemov" <kirill@...temov.name>
To:	Michal Hocko <mhocko@...nel.org>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Minchan Kim <minchan@...nel.org>, linux-mm@...ck.org,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: isolate_lru_page on !head pages

On Tue, Dec 15, 2015 at 09:52:33AM +0100, Michal Hocko wrote:
> On Mon 14-12-15 14:04:56, Kirill A. Shutemov wrote:
> > On Wed, Dec 09, 2015 at 02:02:05PM +0100, Michal Hocko wrote:
> > > Hi Kirill,
> > 
> > [ sorry for late reply, just back from vacation. ]
> > 
> > > while looking at the issue reported by Minchan [1] I have noticed that
> > > there is nothing to prevent from "isolating" a tail page from LRU because
> > > isolate_lru_page checks PageLRU which is
> > > PAGEFLAG(LRU, lru, PF_HEAD)
> > > so it is checked on the head page rather than the given page directly
> > > but the rest of the operation is done on the given (tail) page.
> > 
> > Looks like most (all?) callers already exclude PTE-mapped THP already one
> > way or another.
> 
> I can see e.g. do_move_page_to_node_array not doing a similar thing. It
> isolates and then migrates potentially a tail page.

No, it doesn't. follow_page(FOLL_SPLIT) would split THP pages.

> I haven't looked closer whether there is other hand break on the way
> though. The point I was trying to make is that this is really _subtle_.
> We are changing something else than we operate later on.
> 
> > Probably, VM_BUG_ON_PAGE(PageTail(page), page) in isolate_lru_page() would
> > be appropriate.
> > 
> > > This is really subtle because this expects that every caller of this
> > > function checks for the tail page otherwise we would clobber statistics
> > > and who knows what else (I haven't checked that in detail) as the page
> > > cannot be on the LRU list and the operation makes sense only on the head
> > > page.
> > > 
> > > Would it make more sense to make PageLRU PF_ANY? That would return
> > > false for PageLRU on any tail page and so it would be ignored by
> > > isolate_lru_page.
> > 
> > I don't think this is right way to go. What we put on LRU is compound
> > page, not 4k subpages. PageLRU() should return true if the compound page
> > is on LRU regardless if you ask for head or tail page.
> 
> Hmm, but then we should operate on the head page because that is what
> PageLRU operated on, no?

head page is what linked into LRU, but not nessesary the way we obtain the
page to check. If we check PageLRU(pte_page(*pte)) it should produce the
right result.

> > False-negatives PageLRU() can be as bad as bug Minchan reported, but
> > perhaps more silent.
> 
> -- 
> Michal Hocko
> SUSE Labs

-- 
 Kirill A. Shutemov
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/