linux-kernel - Re: [PATCH 01/12] uprobes: split THPs before trying replace them

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170125174452.GA4157@node>
Date:   Wed, 25 Jan 2017 20:44:52 +0300
From:   "Kirill A. Shutemov" <kirill@...temov.name>
To:     Srikar Dronamraju <srikar@...ux.vnet.ibm.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Hugh Dickins <hughd@...gle.com>,
        Rik van Riel <riel@...hat.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, Oleg Nesterov <oleg@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH 01/12] uprobes: split THPs before trying replace them

On Wed, Jan 25, 2017 at 08:55:22AM -0800, Srikar Dronamraju wrote:
> > > 
> > > > For THPs page_check_address() always fails. It's better to split them
> > > > first before trying to replace.
> > > 
> > > So what does this mean.  uprobes simply fails to work when trying to
> > > place a probe into a THP memory region?
> > 
> > Looks like we can end up with endless retry loop in uprobe_write_opcode().
> > 
> > > How come nobody noticed (and reported) this when using the feature?
> > 
> > I guess it's not often used for anon memory.
> > 
> 
> The first time the breakpoint is hit on a page, it replaces the text
> page with anon page.  Now lets assume we insert breakpoints in all the
> pages in a range. Here each page is individually replaced by a non THP
> anonpage. (since we dont have bulk breakpoint insertion support,
> breakpoint insertion happens one at a time). Now the only interesting
> case may be when each of these replaced pages happen to be physically
> contiguous so that THP kicks in to replace all of these pages with one
> THP page. Can happen in practice?

The problem is with the page you try to replace, not with page that you
replace it with.

> Are there any other cases that I have missed?

The binary on tmpfs with huge pages. I wrote test-case that triggers the
problem.

-- 
 Kirill A. Shutemov