From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752839AbdKFM13 (ORCPT ); Mon, 6 Nov 2017 07:27:29 -0500 Received: from mx2.suse.de ([195.135.220.15]:59657 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752477AbdKFM12 (ORCPT ); Mon, 6 Nov 2017 07:27:28 -0500 Date: Mon, 6 Nov 2017 13:27:26 +0100 From: Michal Hocko To: Bob Liu , Will Deacon Cc: Wang Nan , Linux-MM , Linux-Kernel , Bob Liu , Andrew Morton , David Rientjes , Ingo Molnar , Roman Gushchin , Konstantin Khlebnikov , Andrea Arcangeli Subject: Re: [RFC PATCH] mm, oom_reaper: gather each vma to prevent leaking TLB entry Message-ID: <20171106122726.jwe2ecymlu7qclkk@dhcp22.suse.cz> References: <20171106033651.172368-1-wangnan0@huawei.com> <20171106085251.jwrpgne4dnl4gopy@dhcp22.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171106085251.jwrpgne4dnl4gopy@dhcp22.suse.cz> User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon 06-11-17 09:52:51, Michal Hocko wrote: > On Mon 06-11-17 15:04:40, Bob Liu wrote: > > On Mon, Nov 6, 2017 at 11:36 AM, Wang Nan wrote: > > > tlb_gather_mmu(&tlb, mm, 0, -1) means gathering all virtual memory space. > > > In this case, tlb->fullmm is true. Some archs like arm64 doesn't flush > > > TLB when tlb->fullmm is true: > > > > > > commit 5a7862e83000 ("arm64: tlbflush: avoid flushing when fullmm == 1"). > > > > > > > CC'ed Will Deacon. > > > > > Which makes leaking of tlb entries. For example, when oom_reaper > > > selects a task and reaps its virtual memory space, another thread > > > in this task group may still running on another core and access > > > these already freed memory through tlb entries. > > No threads should be running in userspace by the time the reaper gets to > unmap their address space. So the only potential case is they are > accessing the user memory from the kernel when we should fault and we > have MMF_UNSTABLE to cause a SIGBUS. I hope we have clarified that the tasks are not running in userspace at the time of reaping. I am still wondering whether this is real from the kernel space via copy_{from,to}_user. Is it possible we won't fault? I am not sure I understand what "Given that the ASID allocator will never re-allocate a dirty ASID" means exactly. Will, could you clarify please? -- Michal Hocko SUSE Labs From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg0-f72.google.com (mail-pg0-f72.google.com [74.125.83.72]) by kanga.kvack.org (Postfix) with ESMTP id EA93A6B0261 for ; Mon, 6 Nov 2017 07:27:29 -0500 (EST) Received: by mail-pg0-f72.google.com with SMTP id a192so12679561pge.1 for ; Mon, 06 Nov 2017 04:27:29 -0800 (PST) Received: from mx2.suse.de (mx2.suse.de. [195.135.220.15]) by mx.google.com with ESMTPS id s13si10129275plq.584.2017.11.06.04.27.28 for (version=TLS1 cipher=AES128-SHA bits=128/128); Mon, 06 Nov 2017 04:27:28 -0800 (PST) Date: Mon, 6 Nov 2017 13:27:26 +0100 From: Michal Hocko Subject: Re: [RFC PATCH] mm, oom_reaper: gather each vma to prevent leaking TLB entry Message-ID: <20171106122726.jwe2ecymlu7qclkk@dhcp22.suse.cz> References: <20171106033651.172368-1-wangnan0@huawei.com> <20171106085251.jwrpgne4dnl4gopy@dhcp22.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171106085251.jwrpgne4dnl4gopy@dhcp22.suse.cz> Sender: owner-linux-mm@kvack.org List-ID: To: Bob Liu , Will Deacon Cc: Wang Nan , Linux-MM , Linux-Kernel , Bob Liu , Andrew Morton , David Rientjes , Ingo Molnar , Roman Gushchin , Konstantin Khlebnikov , Andrea Arcangeli On Mon 06-11-17 09:52:51, Michal Hocko wrote: > On Mon 06-11-17 15:04:40, Bob Liu wrote: > > On Mon, Nov 6, 2017 at 11:36 AM, Wang Nan wrote: > > > tlb_gather_mmu(&tlb, mm, 0, -1) means gathering all virtual memory space. > > > In this case, tlb->fullmm is true. Some archs like arm64 doesn't flush > > > TLB when tlb->fullmm is true: > > > > > > commit 5a7862e83000 ("arm64: tlbflush: avoid flushing when fullmm == 1"). > > > > > > > CC'ed Will Deacon. > > > > > Which makes leaking of tlb entries. For example, when oom_reaper > > > selects a task and reaps its virtual memory space, another thread > > > in this task group may still running on another core and access > > > these already freed memory through tlb entries. > > No threads should be running in userspace by the time the reaper gets to > unmap their address space. So the only potential case is they are > accessing the user memory from the kernel when we should fault and we > have MMF_UNSTABLE to cause a SIGBUS. I hope we have clarified that the tasks are not running in userspace at the time of reaping. I am still wondering whether this is real from the kernel space via copy_{from,to}_user. Is it possible we won't fault? I am not sure I understand what "Given that the ASID allocator will never re-allocate a dirty ASID" means exactly. Will, could you clarify please? -- Michal Hocko SUSE Labs -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org