linux-kernel - Re: [v2 PATCH] mm: thp: handle page cache THP correctly in PageTransCompoundMap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 23 Oct 2019 13:00:24 -0700 (PDT)
From:   Hugh Dickins <hughd@...gle.com>
To:     Yang Shi <yang.shi@...ux.alibaba.com>
cc:     Hugh Dickins <hughd@...gle.com>, aarcange@...hat.com,
        kirill.shutemov@...ux.intel.com, gavin.dg@...ux.alibaba.com,
        akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [v2 PATCH] mm: thp: handle page cache THP correctly in
 PageTransCompoundMap

On Wed, 23 Oct 2019, Yang Shi wrote:
> On 10/23/19 12:28 PM, Hugh Dickins wrote:
> > 
> > > +	return map_count >= 0 &&
> > You have added a map_count >= 0 test there. Okay, not wrong, but not
> > necessary, and not consistent with what's returned in the PageAnon
> > case (if this were called for an unmapped page).
> 
> I was thinking about this too. I'm wondering there might be a case that the
> PMD is split and it was the last PMD map, in this case subpage's _mapcount is
> also equal to compound_mapcount (both is -1). So, it would return true, then
> KVM may setup PMD map in EPT, but it might be PTE mapped later on the host.
> But, I'm not quite sure if this is really possible or if this is really a
> integrity problem. So, I thought it might be safer to add this check.

The mmu_notifier_invalidate_range_start.._end() in __split_huge_pmd(),
with KVM's locking and sequence counting, is required to protect
against such races.

Hugh