linux-kernel - Re: [PATCH v2 2/8] smaps: use vm_normal_page_pmd() instead of follow_trans_huge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230802151613.3nyg3xof3gyovlxu@techsingularity.net>
Date:   Wed, 2 Aug 2023 16:16:13 +0100
From:   Mel Gorman <mgorman@...hsingularity.net>
To:     David Hildenbrand <david@...hat.com>
Cc:     linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        linux-fsdevel@...r.kernel.org, kvm@...r.kernel.org,
        linux-kselftest@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        liubo <liubo254@...wei.com>, Peter Xu <peterx@...hat.com>,
        Matthew Wilcox <willy@...radead.org>,
        Hugh Dickins <hughd@...gle.com>,
        Jason Gunthorpe <jgg@...pe.ca>,
        John Hubbard <jhubbard@...dia.com>,
        Mel Gorman <mgorman@...e.de>, Shuah Khan <shuah@...nel.org>,
        Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [PATCH v2 2/8] smaps: use vm_normal_page_pmd() instead of
 follow_trans_huge_pmd()

On Tue, Aug 01, 2023 at 02:48:38PM +0200, David Hildenbrand wrote:
> We shouldn't be using a GUP-internal helper if it can be avoided.
> 
> Similar to smaps_pte_entry() that uses vm_normal_page(), let's use
> vm_normal_page_pmd() that similarly refuses to return the huge zeropage.
> 
> In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd():
> 
> (1) Will always return the head page, not a tail page of a THP.
> 
>  If we'd ever call smaps_account with a tail page while setting "compound
>  = true", we could be in trouble, because smaps_account() would look at
>  the memmap of unrelated pages.
> 
>  If we're unlucky, that memmap does not exist at all. Before we removed
>  PG_doublemap, we could have triggered something similar as in
>  commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for
>  migration entry").
> 
>  This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc:
>  smaps_rollup: do not stall write attempts on mmap_lock"):
> 
>   (a) We're in show_smaps_rollup() and processed a VMA
>   (b) We release the mmap lock in show_smaps_rollup() because it is
>       contended
>   (c) We merged that VMA with another VMA
>   (d) We collapsed a THP in that merged VMA at that position
> 
>  If the end address of the original VMA falls into the middle of a THP
>  area, we would call smap_gather_stats() with a start address that falls
>  into a PMD-mapped THP. It's probably very rare to trigger when not
>  really forced.
> 
> (2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page()
> 
>  Treat such PMDs here just like smaps_pte_entry() would treat such PTEs.
>  If such pages would be anonymous, we most certainly would want to
>  account them.
> 
> (3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap()
> 
>  As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE
>  pages. So just like smaps_pte_entry(), we'll now also ignore such PMD
>  entries.
> 
>  Especially, follow_pmd_mask() never ends up calling
>  follow_trans_huge_pmd() on pmd_devmap(). Instead it calls
>  follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN
>  is set.
> 
>  So skipping pmd_devmap() pages seems to be the right thing to do.
> 
> (4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page()
> 
>  We won't be returning a memmap that should be ignored by core-mm, or
>  worse, a memmap that does not even exist. Note that while
>  walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't.
> 
>  Most probably this case doesn't currently really happen on the PMD level,
>  otherwise we'd already be able to trigger kernel crashes when reading
>  smaps / smaps_rollup.
> 
> So most probably only (1) is relevant in practice as of now, but could only
> cause trouble in extreme corner cases.
> 
> Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock")
> Signed-off-by: David Hildenbrand <david@...hat.com>

Maybe move the follow_trans_huge_pmd() declaration from linux/huge_mm.h
to mm/internal.h to discourage future mistakes? Otherwise

Acked-by: Mel Gorman <mgorman@...hsingularity.net>

-- 
Mel Gorman
SUSE Labs