linux-kernel - [PATCH] mm: compaction: avoid fast_isolate_freepages blindly choose improper pageblock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231206110054.61617-1-v-songbaohua@oppo.com>
Date:   Thu,  7 Dec 2023 00:00:54 +1300
From:   Barry Song <21cnbao@...il.com>
To:     akpm@...ux-foundation.org, baolin.wang@...ux.alibaba.com,
        linux-mm@...ck.org
Cc:     david@...hat.com, hannes@...xchg.org, huzhanyuan@...o.com,
        linux-kernel@...r.kernel.org, mgorman@...hsingularity.net,
        shikemeng@...weicloud.com, v-songbaohua@...o.com,
        willy@...radead.org
Subject: [PATCH] mm: compaction: avoid fast_isolate_freepages blindly choose improper pageblock

Testing shows fast_isolate_freepages can blindly choose an unsuitable
pageblock from time to time particularly while the min mark is used
from XXX path:
 if (!page) {
         cc->fast_search_fail++;
         if (scan_start) {
                 /*
                  * Use the highest PFN found above min. If one was
                  * not found, be pessimistic for direct compaction
                  * and use the min mark.
                  */
                 if (highest >= min_pfn) {
                         page = pfn_to_page(highest);
                         cc->free_pfn = highest;
                 } else {
                         if (cc->direct_compaction && pfn_valid(min_pfn)) { /* XXX */
                                 page = pageblock_pfn_to_page(min_pfn,
                                         min(pageblock_end_pfn(min_pfn),
                                             zone_end_pfn(cc->zone)),
                                         cc->zone);
                                 cc->free_pfn = min_pfn;
                         }
                 }
         }
 }

The reason is that no code is doing any check on the min_pfn
 min_pfn = pageblock_start_pfn(cc->free_pfn - (distance >> 1));

In contrast, slow path of isolate_freepages() is always skipping unsuitable
pageblocks in a decent way.

This issue doesn't happen quite often. When running 25 machines with 16GiB
memory for one night, most of them can hit this unexpected code path.
However the frequency isn't like many times per second. It might be one
time in a couple of hours. Thus, it is very hard to measure the visible
performance impact in my machines though the affection of choosing the
unsuitable migration_target should be negative in theory.

I feel it's still worth fixing this to at least make the code theoretically
self-explanatory as it is quite odd an unsuitable migration_target can be
still migration_target.

Reported-by: Zhanyuan Hu <huzhanyuan@...o.com>
Signed-off-by: Barry Song <v-songbaohua@...o.com>
---
 v1:
    move the fix to the specific min_pfn path with respect to Baolin's comment
 rfc:
    https://lore.kernel.org/linux-mm/20231129104530.63787-1-v-songbaohua@oppo.com/#t

 mm/compaction.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/compaction.c b/mm/compaction.c
index 01ba298739dd..de15a2ef0af5 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1611,6 +1611,9 @@ static void fast_isolate_freepages(struct compact_control *cc)
 						min(pageblock_end_pfn(min_pfn),
 						    zone_end_pfn(cc->zone)),
 						cc->zone);
+					if (page && !suitable_migration_target(cc, page))
+						page = NULL;
+
 					cc->free_pfn = min_pfn;
 				}
 			}
-- 
2.34.1