linux-kernel - Re: + mm-reclaim-madv_free-pages.patch added to -mm tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170307055551.GC29458@bbox>
Date:   Tue, 7 Mar 2017 14:55:51 +0900
From:   Minchan Kim <minchan@...nel.org>
To:     Johannes Weiner <hannes@...xchg.org>,
        Andrew Morton <akpm@...ux-foundation.org>
CC:     <linux-kernel@...r.kernel.org>, <shli@...com>,
        <hillf.zj@...baba-inc.com>, <hughd@...gle.com>,
        <mgorman@...hsingularity.net>, <mhocko@...e.com>,
        <riel@...hat.com>, <mm-commits@...r.kernel.org>
Subject: Re: + mm-reclaim-madv_free-pages.patch added to -mm tree

On Mon, Mar 06, 2017 at 10:49:06AM -0500, Johannes Weiner wrote:

< snip >

> > @@ -1413,20 +1413,24 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
> >  			 * Store the swap location in the pte.
> >  			 * See handle_pte_fault() ...
> >  			 */
> > -			VM_BUG_ON_PAGE(!PageSwapCache(page) && PageSwapBacked(page),
> > -				page);
> > +			if (VM_WARN_ON_ONCE(PageSwapBacked(page) &&
> > +						!PageSwapCache(page))) {
> > +				ret = SWAP_FAIL;
> 
> But you're not adding the !swapbacked && swapcache case?
> 
> > +				page_vma_mapped_walk_done(&pvmw);
> > +				break;
> > +			}
> 
> [...]
> 
> > -			/*
> > -			 * swapin page could be clean, it has data stored in
> > -			 * swap. We can't silently discard it without setting
> > -			 * swap entry in the page table.
> > -			 */
> > -			if (!PageDirty(page) && !PageSwapCache(page)) {
> > -				/* It's a freeable page by MADV_FREE */
> > -				dec_mm_counter(mm, MM_ANONPAGES);
> > -				goto discard;
> > -			} else if (!PageSwapBacked(page)) {
> > -				/* dirty MADV_FREE page */
> > +			/* MADV_FREE page check */
> > +			if (!PageSwapBacked(page)) {
> > +				if (!PageDirty(page)) {
> > +					dec_mm_counter(mm, MM_ANONPAGES);
> > +					goto discard;
> > +				}
> 
> Andrew already has this, you might want to send the warning changes as
> a separate patch on top of this one.

Here it goes.

>From d42d296950c3bbce74afddcff307fa18eef305fe Mon Sep 17 00:00:00 2001
From: Minchan Kim <minchan@...nel.org>
Date: Tue, 7 Mar 2017 14:48:37 +0900
Subject: [PATCH] mm: fix lazyfree bug on check in try_to_unmap_one

If a page is swapbacked, it means it should be in swapcache
in try_to_unmap_one's path.

If a page is !swapbacked, it mean it shouldn't be in swapcache
in try_to_unmap_one's path.

Check both two cases all at once and if it fails, warn and
return SWAP_FAIL. Such bug never mean we should shut down
the kernel.

Suggested-by: Johannes Weiner <hannes@...xchg.org>
Signed-off-by: Minchan Kim <minchan@...nel.org>
---
 mm/rmap.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/mm/rmap.c b/mm/rmap.c
index 35acb83..9925f32 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1413,8 +1413,13 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
 			 * Store the swap location in the pte.
 			 * See handle_pte_fault() ...
 			 */
-			VM_BUG_ON_PAGE(!PageSwapCache(page) && PageSwapBacked(page),
-				page);
+			if (VM_WARN_ON_ONCE(PageSwapBacked(page) !=
+						PageSwapCache(page))) {
+				ret = SWAP_FAIL;
+				page_vma_mapped_walk_done(&pvmw);
+				break;
+
+			}
 
 			/* MADV_FREE page check */
 			if (!PageSwapBacked(page)) {
-- 
2.7.4