linux-kernel - [RFC PATCH v2 3/5] mm: Add explicit page decrement in exception path for isolate_lru

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200819042722.23414.2654.stgit@localhost.localdomain>
Date:   Tue, 18 Aug 2020 21:27:22 -0700
From:   Alexander Duyck <alexander.duyck@...il.com>
To:     alex.shi@...ux.alibaba.com
Cc:     yang.shi@...ux.alibaba.com, lkp@...el.com, rong.a.chen@...el.com,
        khlebnikov@...dex-team.ru, kirill@...temov.name, hughd@...gle.com,
        linux-kernel@...r.kernel.org, alexander.duyck@...il.com,
        daniel.m.jordan@...cle.com, linux-mm@...ck.org,
        shakeelb@...gle.com, willy@...radead.org, hannes@...xchg.org,
        tj@...nel.org, cgroups@...r.kernel.org, akpm@...ux-foundation.org,
        richard.weiyang@...il.com, mgorman@...hsingularity.net,
        iamjoonsoo.kim@....com
Subject: [RFC PATCH v2 3/5] mm: Add explicit page decrement in exception
 path for isolate_lru_pages

From: Alexander Duyck <alexander.h.duyck@...ux.intel.com>

In isolate_lru_pages we have an exception path where if we call
get_page_unless_zero and that succeeds, but TestClearPageLRU fails we call
put_page. Normally this would be problematic but due to the way that the
calls are ordered and the fact that we are holding the LRU lock we know
that the caller must be holding another reference for the page. Since we
can assume that we can replace the put_page with a call to
put_page_testzero contained within a WARN_ON. By doing this we should see
if we ever leak a page as a result of the reference count somehow hitting
zero when it shouldn't, and can avoid the overhead and confusion of using
the full put_page call.

Signed-off-by: Alexander Duyck <alexander.h.duyck@...ux.intel.com>
---
 mm/vmscan.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 5bc0c2322043..3ebe3f9b653b 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1688,10 +1688,13 @@ static unsigned long isolate_lru_pages(unsigned long nr_to_scan,
 
 			if (!TestClearPageLRU(page)) {
 				/*
-				 * This page may in other isolation path,
-				 * but we still hold lru_lock.
+				 * This page is being isolated in another
+				 * thread, but we still hold lru_lock. The
+				 * other thread must be holding a reference
+				 * to the page so this should never hit a
+				 * reference count of 0.
 				 */
-				put_page(page);
+				WARN_ON(put_page_testzero(page));
 				goto busy;
 			}