From: Laurent Dufour <ldufour@linux.ibm.com>
To: Peter Zijlstra <peterz@infradead.org>,
Matthew Wilcox <willy@infradead.org>
Cc: SeongJae Park <sj38.park@gmail.com>,
Michal Hocko <mhocko@suse.com>, Vlastimil Babka <vbabka@suse.cz>,
"Kirill A. Shutemov" <kirill@shutemov.name>,
linux-mm@kvack.org
Subject: Re: Splitting the mmap_sem
Date: Wed, 19 Feb 2020 18:14:41 +0100 [thread overview]
Message-ID: <f62db0a3-21fb-aa0c-4d48-040a5a3eda38@linux.ibm.com> (raw)
In-Reply-To: <20200207085234.GB14914@hirez.programming.kicks-ass.net>
Le 07/02/2020 à 09:52, Peter Zijlstra a écrit :
> On Thu, Feb 06, 2020 at 01:20:24PM -0800, Matthew Wilcox wrote:
>> On Thu, Feb 06, 2020 at 09:55:29PM +0100, Peter Zijlstra wrote:
>>> On Thu, Feb 06, 2020 at 12:15:36PM -0800, Matthew Wilcox wrote:
>>>> then, at the beginning of a page fault call srcu_read_lock(&vma_srcu);
>>>> walk the tree as we do now, allocate memory for PTEs, sleep waiting for
>>>> pages to arrive back from disc, etc, etc, then at the end of the fault,
>>>> call srcu_read_unlock(&vma_srcu).
>>>
>>> So far so good,...
>>>
>>>> munmap() would consist of removing the
>>>> VMA from the tree, then calling synchronize_srcu() to wait for all faults
>>>> to finish, then putting the backing file, etc, etc and freeing the VMA.
>>>
>>> call_srcu(), and the (s)rcu callback will then fput() and such things
>>> more.
>>>
>>> synchronize_srcu() (like synchronize_rcu()) is stupid slow and would
>>> make munmap()/exit()/etc.. unusable.
>>
>> I'll need to think about that a bit. I was convinced we needed to wait
>> for the current pagefaults to finish before we could return from munmap().
>> I need to convince myself that it's OK to return to userspace while the
>> page faults for that range are still proceeding on other CPUs.
>
> File-io might be in progress, any actual faults will result in SIGFAULT
> instead of installing a PTE.
>
> It is not fundamentally different from any threaded uaf race.
>
>>>> This seems pretty reasonable, and investigation could actually proceed
>>>> before the Maple tree work lands. Today, that would be:
>>>>
>>>> srcu_read_lock(&vmas_srcu);
>>>> down_read(&mm->mmap_sem);
>>>> find_vma(mm, address);
>>>> up_read(&mm->mmap_sem);
>>>> ... rest of fault handler path ...
>>>> srcu_read_unlock(&vmas_srcu);
>>>>
>>>> Kind of a pain because we still call find_vma() in the per-arch page
>>>> fault handler, but for prototyping, we'd only have to do one or two
>>>> architectures.
>>>
>>> If you look at the earlier speculative page-fault patches by Laurent,
>>> which were based on my still earlier patches, you'll find most of this
>>> there.
>>>
>>> The tricky bit was validating everything on the second page-table walk,
>>> so see if nothing had fundamentally changed, specifically the VMA,
>>> before installing the PTE. If you do this without mmap_sem, you need to
>>> hold ptlock to pin stuff while validating everything you did earlier.
>>
>> The patches Laurent posted used regular RCU and a per-VMA refcount, not
>> SRCU.
>
> That are his later patches, and I distinctly disagree with that
> approach.
>
> If you look at the patches here:
>
> https://lkml.kernel.org/r/cover.1479465699.git.ldufour@linux.vnet.ibm.com
>
> you'll find it uses SRCU.
For the record, I switched from SRCU to RCU and a ref counter because using
SRCU, the performances were impacted by the scheduling generated to handle
SRCU asynchronous events.
I may have missed something, but using RCU and a ref counter was working
around this 20% overhead.
>> If you use SRCU, why would you need a second page table walk?
>
> Because SRCU only ensures the VMA object remains extant, it does not
> prevent modification of it, normally that guarantee is provided by
> mmap_sem, but we're not going to use that.
>
> Instead, what we serialize on is the (split) ptlock. So we do the first
> page-walk and ptlock to verify the vma-lookup, then we drop ptlock and
> do the file-io, then we page-walk and take ptlock again, verify the vma
> (again) and install the PTE. If anything goes wrong, we bail.
>
> See this patch:
>
> https://lkml.kernel.org/r/301fb863785f37c319b493bd0d43167353871804.1479465699.git.ldufour@linux.vnet.ibm.com
>
prev parent reply other threads:[~2020-02-19 17:14 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-03 22:21 Splitting the mmap_sem Matthew Wilcox
2019-12-05 17:21 ` Jerome Glisse
2019-12-06 5:13 ` Matthew Wilcox
2019-12-06 17:30 ` Jerome Glisse
2019-12-09 3:33 ` Matthew Wilcox
2019-12-09 14:17 ` Jerome Glisse
2019-12-10 15:26 ` Vlastimil Babka
2019-12-10 16:07 ` Jerome Glisse
2019-12-10 18:09 ` Vlastimil Babka
2019-12-12 14:24 ` Kirill A. Shutemov
2019-12-12 15:40 ` Matthew Wilcox
2019-12-12 15:46 ` Kirill A. Shutemov
2019-12-13 14:33 ` Matthew Wilcox
2019-12-13 18:06 ` Kirill A. Shutemov
2019-12-13 18:21 ` Matthew Wilcox
2020-01-06 22:09 ` Matthew Wilcox
2020-01-07 12:34 ` Kirill A. Shutemov
2020-01-07 13:54 ` Matthew Wilcox
2020-01-07 14:27 ` Kirill A. Shutemov
2020-01-09 13:56 ` Vlastimil Babka
2020-01-09 17:03 ` Michal Hocko
2020-01-09 17:07 ` Michal Hocko
2020-01-09 17:32 ` SeongJae Park
2020-01-09 20:13 ` Matthew Wilcox
2020-02-06 13:59 ` Peter Zijlstra
2020-02-06 20:15 ` Matthew Wilcox
2020-02-06 20:55 ` Peter Zijlstra
2020-02-06 21:20 ` Matthew Wilcox
2020-02-07 8:52 ` Peter Zijlstra
2020-02-10 22:00 ` Matthew Wilcox
2020-02-19 17:14 ` Laurent Dufour [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f62db0a3-21fb-aa0c-4d48-040a5a3eda38@linux.ibm.com \
--to=ldufour@linux.ibm.com \
--cc=kirill@shutemov.name \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=peterz@infradead.org \
--cc=sj38.park@gmail.com \
--cc=vbabka@suse.cz \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).