linux-kernel - Re: [PATCH v2 1/2] mm/memfd: refactor memfd_tag_pins() and memfd_wait_for

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 26 Feb 2024 17:56:09 +0100
From: David Hildenbrand <david@...hat.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH v2 1/2] mm/memfd: refactor memfd_tag_pins() and
 memfd_wait_for_pins()

On 26.02.24 17:07, Matthew Wilcox wrote:
> On Mon, Feb 26, 2024 at 03:13:23PM +0100, David Hildenbrand wrote:
>> +	xas_for_each(xas, folio, ULONG_MAX) {
>> +		if (!xa_is_value(folio) && memfd_folio_has_extra_refs(folio))
>>   			xas_set_mark(xas, MEMFD_TAG_PINNED);
> 
> ... we decline to tag value entries here ...
> 
>> @@ -95,20 +90,15 @@ static int memfd_wait_for_pins(struct address_space *mapping)
>>   
>>   		xas_set(&xas, 0);
>>   		xas_lock_irq(&xas);
>> -		xas_for_each_marked(&xas, page, ULONG_MAX, MEMFD_TAG_PINNED) {
>> +		xas_for_each_marked(&xas, folio, ULONG_MAX, MEMFD_TAG_PINNED) {
>>   			bool clear = true;
>>   
>> -			cache_count = 1;
>> -			if (!xa_is_value(page) &&
>> -			    PageTransHuge(page) && !PageHuge(page))
>> -				cache_count = HPAGE_PMD_NR;
>> -
>> -			if (!xa_is_value(page) && cache_count !=
>> -			    page_count(page) - total_mapcount(page)) {
>> +			if (!xa_is_value(folio) &&
>> +			    memfd_folio_has_extra_refs(folio)) {
> 
> ... so we don't need to test it here because we'll never see any value
> entries.  No?

I was not able to convince myself that swapout code would clear the mark 
when replacing the entry.

shmem_writepage()->shmem_delete_from_page_cache()->shmem_replace_entry()

will perform a xas_store() with swp_to_radix_entry(swap) under 
xa_lock_irq().

Reading the doc, and staring at the code for a bit too long, I think 
xas_store() would only clear tags when deleting an entry (passing NULL).

But maybe xas_store() will always clear tags?

In memfd code, I think we could see swapout between memfd_tag_pins() and 
the check for tags, where we drop the xa_lock. Unless some other lock 
(inode lock?) protects us.

Thanks!

-- 
Cheers,

David / dhildenb