linux-kernel - Re: [PATCH] mm: reuse the unshared swapcache page in do_wp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ec0f57e6-f1f6-b9d9-b507-20e845fe7f17@redhat.com>
Date:   Thu, 13 Jan 2022 15:46:54 +0100
From:   David Hildenbrand <david@...hat.com>
To:     Matthew Wilcox <willy@...radead.org>,
        Liang Zhang <zhangliang5@...wei.com>
Cc:     akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, wangzhigang17@...wei.com,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] mm: reuse the unshared swapcache page in do_wp_page

On 13.01.22 15:39, Matthew Wilcox wrote:
> On Thu, Jan 13, 2022 at 10:03:18PM +0800, Liang Zhang wrote:
>> In current implementation, process's read requestions will fault in pages
>> with WP flags in PTEs. Next, if process emit a write requestion will go
>> into do_wp_page() and copy data to a new allocated page from the old one
>> due to refcount > 1 (page table mapped and swapcache), which could be
>> result in performance degradation. In fact, this page is exclusively owned
>> by this process and the duplication from old to a new allocated page is
>> really unnecessary.
>>
>> So In this situation, these unshared pages can be reused by its process.
> 
> Let's bring Linus in on this, but I think this reintroduces all of the
> mapcount problems that we've been discussing recently.
> 
> How about this as an alternative?
> 
> +++ b/mm/memory.c
> @@ -3291,11 +3291,11 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf)
>                 struct page *page = vmf->page;
> 
>                 /* PageKsm() doesn't necessarily raise the page refcount */
> -               if (PageKsm(page) || page_count(page) != 1)
> +               if (PageKsm(page) || page_count(page) != 1 + PageSwapCache(page))
>                         goto copy;
>                 if (!trylock_page(page))
>                         goto copy;
> -               if (PageKsm(page) || page_mapcount(page) != 1 || page_count(page) != 1) {
> +               if (PageKsm(page) || page_mapcount(page) != 1 || page_count(page) != 1 + PageSwapCache(page)) {
>                         unlock_page(page);
>                         goto copy;
>                 }

Funny, I was staring at swap reuse code as I received this mail ...
because if we're not using reuse_swap_page() here anymore, we shouldn't
really be reusing it anywhere for consistency, most prominently in
do_swap_page() when we handle vmf->flags & FAULT_FLAG_WRITE just
similarly as we do here ...

And that's where things get hairy and I am still trying to figure out
all of the details.

Regarding above: If the page is swapped out in multiple processes but
was only faulted into the current process R/O, and then we try to write:

1. Still in the swapcache: PageSwapCache()
2. Mapped only by one process: page_mapcount(page) == 1
3. Reference from one page table and the swap cache: page_count(page) ==

But other processes could read-fault on the swapcache page, no?

I think we'd really have to check against the swapcount as well ...
essentially reuse_swap_page(), no?

-- 
Thanks,

David / dhildenb