linux-kernel - Re: [PATCH 01/12] mm/ksm: catch tail page abnormal in page_stable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fd01f8ec-123e-4739-9a5b-2589eb711563@gmail.com>
Date: Wed, 20 Mar 2024 20:03:10 +0800
From: Alex Shi <seakeel@...il.com>
To: David Hildenbrand <david@...hat.com>, alexs@...nel.org,
 kasong@...cent.com, Andrew Morton <akpm@...ux-foundation.org>,
 "open list:MEMORY MANAGEMENT" <linux-mm@...ck.org>,
 open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 01/12] mm/ksm: catch tail page abnormal in
 page_stable_node



On 3/20/24 5:29 PM, David Hildenbrand wrote:
> On 20.03.24 10:05, Alex Shi wrote:
>>
>>
>> On 3/18/24 8:25 PM, David Hildenbrand wrote:
>>> On 18.03.24 13:14, alexs@...nel.org wrote:
>>>> From: Alex Shi <alexs@...nel.org>
>>>>
>>>> commit 19138349ed59 ("mm/migrate: Add folio_migrate_flags()") change the
>>>> meaning of func page_stable_node() to check the compound head for tail
>>>> 'page' instead of tail page self.
>>>> But seems both semantics are same at results, the func always return NULL
>>>>    for tail page. So adding a bug monitor here in case of abnormal.
>>>>
>>>> Signed-off-by: Alex Shi <alexs@...nel.org>
>>>> Cc: Izik Eidus <izik.eidus@...ellosystems.com>
>>>> Cc: Matthew Wilcox <willy@...radead.org>
>>>> Cc: Andrea Arcangeli <aarcange@...hat.com>
>>>> Cc: Hugh Dickins <hughd@...gle.com>
>>>> Cc: Chris Wright <chrisw@...s-sol.org>
>>>> To: linux-kernel@...r.kernel.org
>>>> To: linux-mm@...ck.org
>>>> To: Andrew Morton <akpm@...ux-foundation.org>
>>>> ---
>>>>    mm/ksm.c | 7 ++++++-
>>>>    1 file changed, 6 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/mm/ksm.c b/mm/ksm.c
>>>> index 8c001819cf10..3ff469961927 100644
>>>> --- a/mm/ksm.c
>>>> +++ b/mm/ksm.c
>>>> @@ -1091,7 +1091,12 @@ static inline struct ksm_stable_node *folio_stable_node(struct folio *folio)
>>>>      static inline struct ksm_stable_node *page_stable_node(struct page *page)
>>>>    {
>>>> -    return folio_stable_node(page_folio(page));
>>>> +    struct ksm_stable_node *node;
>>>> +
>>>> +    node = folio_stable_node(page_folio(page));
>>>> +    VM_BUG_ON_PAGE(PageTail(page) && node, page);
>>>
>>> I don't really understand why we would want this.
>>>
>>> Only KSM folios can have a node in the stable tree. KSM folios cannot be large folios. At that is precisely what folio_stable_node() checks.
>>>
>>> If we'd have a large folio identify as a KSM folio we'd be in much bigger trouble.
>>>
>>>
>>> Besides, I'm sure you read "22) Do not crash the kernel" in Documentation/process/coding-style.rst
>>>
>>
>> Hi David,
>>
>> Thanks for comments!
>> Forgive my stupidity, I understand KSM stable tree has no compound pages, but when searching a tail page in ksm_do_scan(), why we couldn't be in a race, that another VM doing THP collapse on the same contents pages, while the 3rd vm is doing hugepage spliting?
> 
> We always call cmp_and_merge_page() while holding a reference on the page.
> 
> There, we call page_stable_node() directly and via stable_tree_search()->page_stable_node() on that page.
> 
> When stable_tree_search() returns a kpage, we also hold a reference to that kpage. So calling page_stable_node() on the kpage behaves the same.
> 
> As we are holding page references, pages cannot be split/merged and we should not see any races in page_stable_node().
> 
> Am I missing something?
> 
> Note that your change would also not help here: if it would be racy, you'd also not reliably catch any tail pages.
> 
> But it should not be racy unless I am missing something.
> 

Hi David,

Thanks for the info, I see.

BTW, I should cc you for my KSM folio patchset review: https://lore.kernel.org/linux-mm/20240320074049.4130552-2-alexs@kernel.org/

Best regards!
Alex