linux-kernel - Re: [PATCH RFC 1/4] mm/mremap: Optimize the start addresses in move_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230518144440.GA813364@google.com>
Date:   Thu, 18 May 2023 14:44:40 +0000
From:   Joel Fernandes <joel@...lfernandes.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org,
        linux-mm@...ck.org, Shuah Khan <shuah@...nel.org>,
        Vlastimil Babka <vbabka@...e.cz>,
        Michal Hocko <mhocko@...e.com>,
        Lorenzo Stoakes <lstoakes@...il.com>,
        Kirill A Shutemov <kirill@...temov.name>,
        "Liam R. Howlett" <liam.howlett@...cle.com>,
        "Paul E. McKenney" <paulmck@...nel.org>
Subject: Re: [PATCH RFC 1/4] mm/mremap: Optimize the start addresses in
 move_page_tables()

On Wed, May 17, 2023 at 09:12:07PM -0700, Linus Torvalds wrote:
> On Wed, May 17, 2023 at 7:18 PM Joel Fernandes (Google)
> <joel@...lfernandes.org> wrote:
> >
> > This warning will only trigger when there is mutual alignment in the
> > move operation. A solution, as suggested by Linus Torvalds [2], is to
> > initiate the copy process at the PMD level whenever such alignment is
> > present.
> 
> So this patch is actually simpler than I thought it would be.
> 
> But I'm a bit nervous about it. In particular, it ends doing
> 
>         old_end = old_addr + len;
>         ... expand old_addr/new_addr down to the pmd boundary ..
>         return len + old_addr - old_end;        /* how much done */
> 
> doesn't that return value end up being nonsensical now?

Aargh, Sorry to miss that. Yes, it ends up being bogus in the case where the
loop broke out early due to failure (but only on the first PMD move failure
AFAICS). In the success case (or failures after the first PMD move), it does
not matter because old_addr is updated to what it was without the
optimization.

> In particular, I think it can return a *negative* value, because of
> how old_addr was moved down, and the "now much done" might indeed be
> "negative" in the sense that it failed the move even "before" the
> original starting point.
> 
> And that negative value then ends up being a large positive one as an
> "unsigned long", of course.
> 
> So I get the feeling that it wants something like
> 
>         if (old_addr + len < old_end)
>                 return 0;

I think that will fix it (thanks!). The main thing I think is to not mess up
the second call to move_page_tables() in mremap where it tries to move the
half-moved stuff back:

  move_page_tables(new_vma, new_addr, vma, old_addr, moved_len,  true);

There moved_len comes from the return value of the first call to
move_page_tables().

If we realigned, and then the first PMD alloc failed, moved_len might be
negative as you pointed. If the first PMD move passed, then there is no
issue as I mentioned above.

I will fix this in the next revision and also add a test case for this, I am
wondering how to test it without some kind of error-injection to make the
first PMD copy fail. In any case, I will try to hack my local kernel to test
that.

thanks,

 - Joel

> there at the end.
> 
> But maybe there is something in there that guarantees that that case
> never happens. I didn't think too deeply about it, I just felt this
> looked odd.
> 
>                Linus