lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 1 Dec 2022 12:47:33 -0700 From: Yu Zhao <yuzhao@...gle.com> To: Axel Rasmussen <axelrasmussen@...gle.com> Cc: Andrew Morton <akpm@...ux-foundation.org>, Suleiman Souhlal <suleiman@...gle.com>, Steven Barrett <steven@...uorix.net>, Oleksandr Natalenko <oleksandr@...alenko.name>, Suren Baghdasaryan <surenb@...gle.com>, Arnd Bergmann <arnd@...db.de>, Peter Xu <peterx@...hat.com>, Gaosheng Cui <cuigaosheng1@...wei.com>, Hugh Dickins <hughd@...gle.com>, Brian Geffon <bgeffon@...gle.com>, "Jan Alexander Steffens (heftig)" <heftig@...hlinux.org>, linux-kernel@...r.kernel.org, Yosry Ahmed <yosryahmed@...gle.com> Subject: Re: [PATCH] mm: multi-gen LRU: fix LRU size accounting on folio removal On Thu, Dec 1, 2022 at 12:26 PM Axel Rasmussen <axelrasmussen@...gle.com> wrote: > > When removing a folio from MGLRU, we want to update the LRU size > accordingly based on the generation it belonged to previously - > lru_gen_update_size() does this. > > The bug here is, set_mask_bits effectively clears the generation bits. > Ignoring the complexity set_mask_bits is meant to handle, the code being > changed here is in effect: > > flags = !reclaiming && lru_gen_is_active(lruvec, gen) ? BIT(PG_active) : 0; > flags = *folio->flags = (*folio->flags & ~LRU_GEN_MASK) | flags; > gen = ((flags & LRU_GEN_MASK) >> LRU_GEN_PGOFF) - 1; > > In other words, the bug is we clear all of the `LGU_GEN_MASK` bits, and > then we recalculate `gen` - but of course after clearing the bits > `flags & LRU_GEN_MASK` is always zero, and so now `gen` is always -1. > > So we effectively always call: > > lru_gen_update_size(lruvec, folio, -1, -1); > > This leads `lru_gen_update_size` to incorrectly conclude that we're > **adding**, not removing, a folio. We take this path: > > /* addition */ > if (old_gen < 0) { > /* always false, new_gen is -1 too */ > if (lru_gen_is_active(lruvec, new_gen)) > /* ... */ > __update_lru_size(lruvec, lru, zone, delta); > return; > } > > In other words, when removing, we incorrectly *add* the delta to the > inactive LRU instead of subtracting. > > The fix is simple. We already have the generation number the folio > belonged to: we set `int gen = folio_lru_gen(folio);` at the top of > `lru_gen_del_folio`. So, just delete the line incorrectly recalculating > the generation number. > > Fixes: ec1c86b25f4b ("mm: multi-gen LRU: groundwork") > Signed-off-by: Axel Rasmussen <axelrasmussen@...gle.com> NAK. You are referencing our old (9xx) set_mask_bits(), which returns "new" (a bad behavior). Its latest version returns "old". Even if it was a bug: 1. lru_gen_update_size(lruvec, folio, -1, -1) would have been caught by VM_WARN_ON_ONCE(old_gen == -1 && new_gen == -1). 2. The fix is still wrong, because "gen" read from folio_lru_gen(folio) is non atomic and can change before set_mask_bits() finishes.
Powered by blists - more mailing lists