linux-kernel - Re: Suspicious error for CMA stress test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 18 Mar 2016 14:32:35 +0100
From:	Lucas Stach <l.stach@...gutronix.de>
To:	Joonsoo Kim <js1304@...il.com>, Vlastimil Babka <vbabka@...e.cz>
Cc:	Laura Abbott <lauraa@...eaurora.org>,
	Arnd Bergmann <arnd@...db.de>,
	Catalin Marinas <Catalin.Marinas@....com>,
	Hanjun Guo <guohanjun@...wei.com>,
	Will Deacon <will.deacon@....com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	qiuxishi <qiuxishi@...wei.com>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	dingtinahong <dingtianhong@...wei.com>,
	"Leizhen (ThunderTown)" <thunder.leizhen@...wei.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Joonsoo Kim <iamjoonsoo.kim@....com>,
	Laura Abbott <labbott@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>, chenjie6@...wei.com
Subject: Re: Suspicious error for CMA stress test

Hi Vlastimil, Joonsoo,

Am Freitag, den 18.03.2016, 00:52 +0900 schrieb Joonsoo Kim:
> 2016-03-18 0:43 GMT+09:00 Vlastimil Babka <vbabka@...e.cz>:
> > On 03/17/2016 10:24 AM, Hanjun Guo wrote:
> >>
> >> On 2016/3/17 14:54, Joonsoo Kim wrote:
> >>>
> >>> On Wed, Mar 16, 2016 at 05:44:28PM +0800, Hanjun Guo wrote:
> >>>>
> >>>> On 2016/3/14 15:18, Joonsoo Kim wrote:
> >>>>>
> >>>>> On Mon, Mar 14, 2016 at 08:06:16AM +0100, Vlastimil Babka wrote:
> >>>>>>
> >>>>>> On 03/14/2016 07:49 AM, Joonsoo Kim wrote:
> >>>>>>>
> >>>>>>> On Fri, Mar 11, 2016 at 06:07:40PM +0100, Vlastimil Babka wrote:
> >>>>>>>>
> >>>>>>>> On 03/11/2016 04:00 PM, Joonsoo Kim wrote:
> >>>>>>>>
> >>>>>>>> How about something like this? Just and idea, probably buggy
> >>>>>>>> (off-by-one etc.).
> >>>>>>>> Should keep away cost from <pageblock_order iterations at the
> >>>>>>>> expense of the
> >>>>>>>> relatively fewer >pageblock_order iterations.
> >>>>>>>
> >>>>>>> Hmm... I tested this and found that it's code size is a little bit
> >>>>>>> larger than mine. I'm not sure why this happens exactly but I guess
> >>>>>>> it would be
> >>>>>>> related to compiler optimization. In this case, I'm in favor of my
> >>>>>>> implementation because it looks like well abstraction. It adds one
> >>>>>>> unlikely branch to the merge loop but compiler would optimize it to
> >>>>>>> check it once.
> >>>>>>
> >>>>>> I would be surprised if compiler optimized that to check it once, as
> >>>>>> order increases with each loop iteration. But maybe it's smart
> >>>>>> enough to do something like I did by hand? Guess I'll check the
> >>>>>> disassembly.
> >>>>>
> >>>>> Okay. I used following slightly optimized version and I need to
> >>>>> add 'max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1)'
> >>>>> to yours. Please consider it, too.
> >>>>
> >>>> Hmm, this one is not work, I still can see the bug is there after
> >>>> applying
> >>>> this patch, did I miss something?
> >>>
> >>> I may find that there is a bug which was introduced by me some time
> >>> ago. Could you test following change in __free_one_page() on top of
> >>> Vlastimil's patch?
> >>>
> >>> -page_idx = pfn & ((1 << max_order) - 1);
> >>> +page_idx = pfn & ((1 << MAX_ORDER) - 1);
> >>
> >>
> >> I tested Vlastimil's patch + your change with stress for more than half
> >> hour, the bug
> >> I reported is gone :)
> >
> >
> > Oh, ok, will try to send proper patch, once I figure out what to write in
> > the changelog :)
> 
> Thanks in advance!

After digging into the "PFN busy" race in CMA (see [1]), I believe we
should just prevent any buddy merging in isolated ranges. This fixes the
race I'm seeing without the need to hold the zone lock for extend
periods of time.
Also any merging done in an isolated range is likely to be completely
wasted work, as higher order buddy pages are broken up again into single
pages in isolate_freepages.

If we do that the patch to fix the bug in question for this report would
boil down to a check if the current pages buddy is isolated and abort
merging at that point, right? undo_isolate_page_range will then do all
necessary merging that has been skipped while the range was isolated.

Do you see issues with this approach?

Regards,
Lucas

[1] http://thread.gmane.org/gmane.linux.kernel.mm/148383