From: Minchan Kim <minchan@kernel.org>
To: Nadav Amit <namit@vmware.com>
Cc: linux-mm@kvack.org, nadav.amit@gmail.com,
linux-kernel@vger.kernel.org, akpm@linux-foundation.org
Subject: Re: [PATCH v6 0/7] fixes of TLB batching races
Date: Thu, 3 Aug 2017 08:26:24 +0900 [thread overview]
Message-ID: <20170802232624.GB32020@bbox> (raw)
In-Reply-To: <20170802000818.4760-1-namit@vmware.com>
On Tue, Aug 01, 2017 at 05:08:11PM -0700, Nadav Amit wrote:
> It turns out that Linux TLB batching mechanism suffers from various races.
> Races that are caused due to batching during reclamation were recently
> handled by Mel and this patch-set deals with others. The more fundamental
> issue is that concurrent updates of the page-tables allow for TLB flushes
> to be batched on one core, while another core changes the page-tables.
> This other core may assume a PTE change does not require a flush based on
> the updated PTE value, while it is unaware that TLB flushes are still
> pending.
>
> This behavior affects KSM (which may result in memory corruption) and
> MADV_FREE and MADV_DONTNEED (which may result in incorrect behavior). A
> proof-of-concept can easily produce the wrong behavior of MADV_DONTNEED.
> Memory corruption in KSM is harder to produce in practice, but was observed
> by hacking the kernel and adding a delay before flushing and replacing the
> KSM page.
>
> Finally, there is also one memory barrier missing, which may affect
> architectures with weak memory model.
>
> v5 -> v6:
> * Combining with Minchan Kim's patch set, adding ack's (Andrew)
> * Minor: missing header, typos (Nadav)
> * Renaming arch_generic_tlb_finish_mmu (Mel)
Thanks for intergrating/correction, Nadav.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
prev parent reply other threads:[~2017-08-02 23:26 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-02 0:08 [PATCH v6 0/7] fixes of TLB batching races Nadav Amit
2017-08-02 0:08 ` [PATCH v6 1/7] mm: migrate: prevent racy access to tlb_flush_pending Nadav Amit
2017-08-02 0:08 ` [PATCH v6 2/7] mm: migrate: fix barriers around tlb_flush_pending Nadav Amit
2017-08-02 0:08 ` [PATCH v6 3/7] Revert "mm: numa: defer TLB flush for THP migration as long as possible" Nadav Amit
2017-08-11 10:50 ` Peter Zijlstra
2017-08-02 0:08 ` [PATCH v6 4/7] mm: refactoring TLB gathering API Nadav Amit
2017-08-11 9:23 ` Peter Zijlstra
2017-08-11 17:12 ` Nadav Amit
2017-08-14 0:49 ` Minchan Kim
2017-08-02 0:08 ` [PATCH v6 5/7] mm: make tlb_flush_pending global Nadav Amit
2017-08-02 14:28 ` kbuild test robot
2017-08-02 23:23 ` Minchan Kim
2017-08-02 23:27 ` Andrew Morton
2017-08-02 23:34 ` Minchan Kim
2017-08-03 16:40 ` kbuild test robot
2017-08-02 0:08 ` [PATCH v6 6/7] mm: fix MADV_[FREE|DONTNEED] TLB flush miss problem Nadav Amit
2017-08-08 1:19 ` [lkp-robot] [mm] 7674270022: will-it-scale.per_process_ops -19.3% regression kernel test robot
2017-08-08 2:28 ` Minchan Kim
2017-08-08 4:23 ` Nadav Amit
2017-08-08 5:51 ` Nadav Amit
2017-08-08 8:08 ` Minchan Kim
2017-08-08 8:16 ` Nadav Amit
2017-08-09 1:25 ` Ye Xiaolong
2017-08-09 2:59 ` Ye Xiaolong
2017-08-10 4:13 ` Minchan Kim
2017-08-10 4:14 ` Nadav Amit
2017-08-10 4:20 ` Minchan Kim
2017-08-11 13:30 ` [PATCH v6 6/7] mm: fix MADV_[FREE|DONTNEED] TLB flush miss problem Peter Zijlstra
2017-08-13 6:14 ` Nadav Amit
2017-08-13 12:08 ` Peter Zijlstra
2017-08-14 1:26 ` Minchan Kim
2017-08-02 0:08 ` [PATCH v6 7/7] mm: fix KSM data corruption Nadav Amit
2017-08-02 23:26 ` Minchan Kim [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170802232624.GB32020@bbox \
--to=minchan@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=nadav.amit@gmail.com \
--cc=namit@vmware.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).