linux-kernel - Re: get_zone_device_page() in get_page() and page_cache_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 24 Apr 2017 10:47:43 -0700
From:   Dan Williams <dan.j.williams@...el.com>
To:     "Kirill A. Shutemov" <kirill@...temov.name>
Cc:     Linux MM <linux-mm@...ck.org>,
        Catalin Marinas <catalin.marinas@....com>,
        "Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>,
        Steve Capper <steve.capper@...aro.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Borislav Petkov <bp@...en8.de>, Rik van Riel <riel@...hat.com>,
        Dann Frazier <dann.frazier@...onical.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Michal Hocko <mhocko@...e.cz>,
        linux-tip-commits@...r.kernel.org
Subject: Re: get_zone_device_page() in get_page() and page_cache_get_speculative()

On Mon, Apr 24, 2017 at 10:30 AM, Kirill A. Shutemov
<kirill@...temov.name> wrote:
> On Mon, Apr 24, 2017 at 10:23:59AM -0700, Dan Williams wrote:
>> On Sun, Apr 23, 2017 at 4:31 PM, Kirill A. Shutemov
>> <kirill@...temov.name> wrote:
>> > On Thu, Apr 20, 2017 at 02:46:51PM -0700, Dan Williams wrote:
>> >> On Sat, Mar 18, 2017 at 2:52 AM, tip-bot for Kirill A. Shutemov
>> >> <tipbot@...or.com> wrote:
>> >> > Commit-ID:  2947ba054a4dabbd82848728d765346886050029
>> >> > Gitweb:     http://git.kernel.org/tip/2947ba054a4dabbd82848728d765346886050029
>> >> > Author:     Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
>> >> > AuthorDate: Fri, 17 Mar 2017 00:39:06 +0300
>> >> > Committer:  Ingo Molnar <mingo@...nel.org>
>> >> > CommitDate: Sat, 18 Mar 2017 09:48:03 +0100
>> >> >
>> >> > x86/mm/gup: Switch GUP to the generic get_user_page_fast() implementation
>> >> >
>> >> > This patch provides all required callbacks required by the generic
>> >> > get_user_pages_fast() code and switches x86 over - and removes
>> >> > the platform specific implementation.
>> >> >
>> >> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
>> >> > Cc: Andrew Morton <akpm@...ux-foundation.org>
>> >> > Cc: Aneesh Kumar K . V <aneesh.kumar@...ux.vnet.ibm.com>
>> >> > Cc: Borislav Petkov <bp@...en8.de>
>> >> > Cc: Catalin Marinas <catalin.marinas@....com>
>> >> > Cc: Dann Frazier <dann.frazier@...onical.com>
>> >> > Cc: Dave Hansen <dave.hansen@...el.com>
>> >> > Cc: H. Peter Anvin <hpa@...or.com>
>> >> > Cc: Linus Torvalds <torvalds@...ux-foundation.org>
>> >> > Cc: Peter Zijlstra <peterz@...radead.org>
>> >> > Cc: Rik van Riel <riel@...hat.com>
>> >> > Cc: Steve Capper <steve.capper@...aro.org>
>> >> > Cc: Thomas Gleixner <tglx@...utronix.de>
>> >> > Cc: linux-arch@...r.kernel.org
>> >> > Cc: linux-mm@...ck.org
>> >> > Link: http://lkml.kernel.org/r/20170316213906.89528-1-kirill.shutemov@linux.intel.com
>> >> > [ Minor readability edits. ]
>> >> > Signed-off-by: Ingo Molnar <mingo@...nel.org>
>> >>
>> >> I'm still trying to spot the bug, but bisect points to this patch as
>> >> the point at which my unit tests start failing with the following
>> >> signature:
>> >>
>> >> [   35.423841] WARNING: CPU: 8 PID: 245 at lib/percpu-refcount.c:155
>> >> percpu_ref_switch_to_atomic_rcu+0x1f5/0x200
>> >
>> > Okay, I've tracked it down. The issue is triggered by replacment
>> > get_page() with page_cache_get_speculative().
>> >
>> > page_cache_get_speculative() doesn't have get_zone_device_page(). :-|
>> >
>> > And I think it's your bug, Dan: it's wrong to have
>> > get_/put_zone_device_page() in get_/put_page(). I must be handled by
>> > page_ref_* machinery to catch all cases where we manipulate with page
>> > refcount.
>>
>> The page_ref conversion landed in 4.6 *after* the ZONE_DEVICE
>> implementation that landed in 4.5, so there was a missed conversion of
>> the zone-device reference counting to page_ref.
>
> Fair enough.
>
> But get_page_unless_zero() definitely predates ZONE_DEVICE. :)
>

It does, but that's deliberate. A ZONE_DEVICE page never has a zero
reference count, it's always owned by the device, never by the page
allocator. ZONE_DEVICE overrides the ->lru list_head to store private
device information and we rely on the behavior that a non-zero
reference means the page is not added to any lru or page cache list.