linux-kernel - Re: [PATCH v2] mm: thp: fix potential clearing to referenced flag in page_idle_clear_pte_refs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 9 Feb 2018 13:23:14 -0800
From:   Yang Shi <yang.shi@...ux.alibaba.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     kirill.shutemov@...ux.intel.com, gavin.dg@...ux.alibaba.com,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] mm: thp: fix potential clearing to referenced flag in
 page_idle_clear_pte_refs_one()



On 2/9/18 12:43 PM, Andrew Morton wrote:
> On Sat, 10 Feb 2018 03:12:01 +0800 Yang Shi <yang.shi@...ux.alibaba.com> wrote:
>
>> For PTE-mapped THP, the compound THP has not been split to normal 4K
>> pages yet, the whole THP is considered referenced if any one of sub
>> page is referenced.
>>
>> When walking PTE-mapped THP by pvmw, all relevant PTEs will be checked
>> to retrieve referenced bit. But, the current code just returns the
>> result of the last PTE. If the last PTE has not referenced, the
>> referenced flag will be cleared.
>>
>> Just did logical OR for referenced to get the correct result.
>>
>> Reported-by: Gang Deng <gavin.dg@...ux.alibaba.com>
>> Suggested-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
>> Signed-off-by: Yang Shi <yang.shi@...ux.alibaba.com>
>> ---
>> v2: adopted the suggestion from Kirill. Not use "||=" style to keep checkpatch
>> quiet, otherwise it reports ERROR: spaces required around that '||'
>>
>>   mm/page_idle.c | 12 ++++++++----
>>   1 file changed, 8 insertions(+), 4 deletions(-)
>>
>> diff --git a/mm/page_idle.c b/mm/page_idle.c
>> index 0a49374..a4baec9 100644
>> --- a/mm/page_idle.c
>> +++ b/mm/page_idle.c
>> @@ -65,11 +65,15 @@ static bool page_idle_clear_pte_refs_one(struct page *page,
>>   	while (page_vma_mapped_walk(&pvmw)) {
>>   		addr = pvmw.address;
>>   		if (pvmw.pte) {
>> -			referenced = ptep_clear_young_notify(vma, addr,
>> -					pvmw.pte);
>> +			/*
>> +			 * For PTE-mapped THP, one sub page is referenced,
>> +			 * the whole THP is referenced.
>> +			 */
>> +			referenced = referenced || ptep_clear_young_notify(vma,
>> +					addr, pvmw.pte);
> That doesn't work.  If `referenced' is already true,
> ptep_clear_young_notify() will not be called.
>
> 	if (ptep_clear_young_notify(...))
> 		referenced = true;
>
> would suit.

Thanks for pointing out this. Sorry for the careless programming.

>
>
> It makes me wonder what difference this bug makes and why that
> difference was not noted in your testing.  Any theories about that?
> How can we design a test which *will* make this error apparent?

Actually, there is NOT an apparent test for this issue yet. It was found 
by visual inspection when we were backporting the PVMW patches. And, it 
is not that easy to construct a test for idle page tracking to capture 
this trivial miscounting (might be just one page difference). The 
counting is global not per process and it is always increased unless 
resetting the reference bit.

Any good idea?

Thanks,
Yang