linux-kernel - Re: [PATCH] mm: reuse the unshared swapcache page in do_wp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Jan 2022 15:02:37 +0000
From:   Matthew Wilcox <willy@...radead.org>
To:     David Hildenbrand <david@...hat.com>
Cc:     Liang Zhang <zhangliang5@...wei.com>, akpm@...ux-foundation.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        wangzhigang17@...wei.com,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] mm: reuse the unshared swapcache page in do_wp_page

On Thu, Jan 13, 2022 at 03:46:54PM +0100, David Hildenbrand wrote:
> On 13.01.22 15:39, Matthew Wilcox wrote:
> > On Thu, Jan 13, 2022 at 10:03:18PM +0800, Liang Zhang wrote:
> >> In current implementation, process's read requestions will fault in pages
> >> with WP flags in PTEs. Next, if process emit a write requestion will go
> >> into do_wp_page() and copy data to a new allocated page from the old one
> >> due to refcount > 1 (page table mapped and swapcache), which could be
> >> result in performance degradation. In fact, this page is exclusively owned
> >> by this process and the duplication from old to a new allocated page is
> >> really unnecessary.
> >>
> >> So In this situation, these unshared pages can be reused by its process.
> > 
> > Let's bring Linus in on this, but I think this reintroduces all of the
> > mapcount problems that we've been discussing recently.
> > 
> > How about this as an alternative?
> > 
> > +++ b/mm/memory.c
> > @@ -3291,11 +3291,11 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf)
> >                 struct page *page = vmf->page;
> > 
> >                 /* PageKsm() doesn't necessarily raise the page refcount */
> > -               if (PageKsm(page) || page_count(page) != 1)
> > +               if (PageKsm(page) || page_count(page) != 1 + PageSwapCache(page))
> >                         goto copy;
> >                 if (!trylock_page(page))
> >                         goto copy;
> > -               if (PageKsm(page) || page_mapcount(page) != 1 || page_count(page) != 1) {
> > +               if (PageKsm(page) || page_mapcount(page) != 1 || page_count(page) != 1 + PageSwapCache(page)) {
> >                         unlock_page(page);
> >                         goto copy;
> >                 }
> 
> Funny, I was staring at swap reuse code as I received this mail ...
> because if we're not using reuse_swap_page() here anymore, we shouldn't
> really be reusing it anywhere for consistency, most prominently in
> do_swap_page() when we handle vmf->flags & FAULT_FLAG_WRITE just
> similarly as we do here ...
> 
> And that's where things get hairy and I am still trying to figure out
> all of the details.
> 
> Regarding above: If the page is swapped out in multiple processes but
> was only faulted into the current process R/O, and then we try to write:
> 
> 1. Still in the swapcache: PageSwapCache()
> 2. Mapped only by one process: page_mapcount(page) == 1
> 3. Reference from one page table and the swap cache: page_count(page) ==
> 
> But other processes could read-fault on the swapcache page, no?
> 
> I think we'd really have to check against the swapcount as well ...
> essentially reuse_swap_page(), no?

Unfortunately the last digit is missing from your "3.", but I
think you're absolutely right; we need to check swapcount.  So
once reuse_swap_page() checks page_count instead of mapcount, we'll
be good?