[PATCH] mm: allow page_cache_get_speculative in interrupt context

[PATCH] mm: allow page_cache_get_speculative in interrupt context

[kan.liang]

From: Kan Liang <kan.liang@intel.com>

Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
handler.

The bug was introduced by commit:

  2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
get_user_page_fast() implementation")

The original x86 __get_user_page_fast used plain get_page() or
page_ref_add(). However, the generic __get_user_page_fast uses
page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).

There is no reason to prevent page_cache_get_speculative from using in
interrupt context. According to the author, putting a BUG_ON there is
just because the code is not verifying correctness of interrupt races.
I did some tests in interrupt context. There is no issue found.
Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().

Signed-off-by: Kan Liang <kan.liang@intel.com>
---
 include/linux/pagemap.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index baa9344..79b36f5 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -163,8 +163,6 @@ void release_pages(struct page **pages, int nr, bool cold);
  */
 static inline int page_cache_get_speculative(struct page *page)
 {
-	VM_BUG_ON(in_interrupt());
-
 #ifdef CONFIG_TINY_RCU
 # ifdef CONFIG_PREEMPT_COUNT
 	VM_BUG_ON(!in_atomic() && !irqs_disabled());
-- 
2.4.3

Re: [PATCH] mm: allow page_cache_get_speculative in interrupt context

[Andrew Morton]

On Tue,  1 Aug 2017 13:39:06 -0400 kan.liang@intel.com wrote:

> Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
> handler.
> 
> The bug was introduced by commit:
> 
>   2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
> get_user_page_fast() implementation")
> 
> The original x86 __get_user_page_fast used plain get_page() or
> page_ref_add(). However, the generic __get_user_page_fast uses
> page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).
> 
> There is no reason to prevent page_cache_get_speculative from using in
> interrupt context. According to the author, putting a BUG_ON there is
> just because the code is not verifying correctness of interrupt races.
> I did some tests in interrupt context. There is no issue found.
> Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().

What code calls page_cache_get_speculative() from NMI context?  

I'm trying to work out which kernel versions need this fix, but there
isn't enough info in the changelog for this.  Please don't do that.

RE: [PATCH] mm: allow page_cache_get_speculative in interrupt context

[Liang, Kan]

> 
> On Tue,  1 Aug 2017 13:39:06 -0400 kan.liang@intel.com wrote:
> 
> > Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
> > handler.
> >
> > The bug was introduced by commit:
> >
> >   2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
> > get_user_page_fast() implementation")
> >
> > The original x86 __get_user_page_fast used plain get_page() or
> > page_ref_add(). However, the generic __get_user_page_fast uses
> > page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).
> >
> > There is no reason to prevent page_cache_get_speculative from using in
> > interrupt context. According to the author, putting a BUG_ON there is
> > just because the code is not verifying correctness of interrupt races.
> > I did some tests in interrupt context. There is no issue found.
> > Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().
> 
> What code calls page_cache_get_speculative() from NMI context?
>

The code I'm implementing will call __get_user_page_fast from NMI context.
__get_user_page_fast will eventually call page_cache_get_speculative().
 
> I'm trying to work out which kernel versions need this fix, but there isn't
> enough info in the changelog for this.  Please don't do that.

Sorry for the confusion.

According to the comments, __get_user_page_fast should be IRQ-safe. But it's not.
This patch could be used to resolve the inconsistencies between the comments
and implementations for now.
The generic __get_user_page_fast was introduced by the commit
2667f50e8b81457fcb4a3dbe6aff3e81ea009e13
mm: introduce a general RCU get_user_pages_fast()
I think the kernel after the commit should be fixed.

Thanks,
Kan

Re: [PATCH] mm: allow page_cache_get_speculative in interrupt context

[Kirill A. Shutemov]

On Tue, Aug 01, 2017 at 08:31:14PM +0000, Liang, Kan wrote:
> > 
> > On Tue,  1 Aug 2017 13:39:06 -0400 kan.liang@intel.com wrote:
> > 
> > > Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
> > > handler.
> > >
> > > The bug was introduced by commit:
> > >
> > >   2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
> > > get_user_page_fast() implementation")
> > >
> > > The original x86 __get_user_page_fast used plain get_page() or
> > > page_ref_add(). However, the generic __get_user_page_fast uses
> > > page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).
> > >
> > > There is no reason to prevent page_cache_get_speculative from using in
> > > interrupt context. According to the author, putting a BUG_ON there is
> > > just because the code is not verifying correctness of interrupt races.
> > > I did some tests in interrupt context. There is no issue found.
> > > Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().
> > 
> > What code calls page_cache_get_speculative() from NMI context?
> >
> 
> The code I'm implementing will call __get_user_page_fast from NMI context.
> __get_user_page_fast will eventually call page_cache_get_speculative().
>  
> > I'm trying to work out which kernel versions need this fix, but there isn't
> > enough info in the changelog for this.  Please don't do that.
> 
> Sorry for the confusion.
> 
> According to the comments, __get_user_page_fast should be IRQ-safe. But it's not.
> This patch could be used to resolve the inconsistencies between the comments
> and implementations for now.
> The generic __get_user_page_fast was introduced by the commit
> 2667f50e8b81457fcb4a3dbe6aff3e81ea009e13
> mm: introduce a general RCU get_user_pages_fast()
> I think the kernel after the commit should be fixed.

I don't think so.

It's 2+ year in and nobody stepped onto this until you with your patchset.
There is no real reason to get it backported.

-- 
 Kirill A. Shutemov