On 9/28/21 6:24 AM, Song Liu wrote: > On Fri, Sep 24, 2021 at 12:12 AM Rongwei Wang > wrote: >> >> >> >> On 9/24/21 10:43 AM, Andrew Morton wrote: >>> On Thu, 23 Sep 2021 01:04:54 +0800 Rongwei Wang wrote: >>> >>>> >>>> >>>>> On Sep 22, 2021, at 7:37 PM, Matthew Wilcox wrote: >>>>> >>>>> On Wed, Sep 22, 2021 at 03:06:44PM +0800, Rongwei Wang wrote: >>>>>> Transparent huge page has supported read-only non-shmem files. The file- >>>>>> backed THP is collapsed by khugepaged and truncated when written (for >>>>>> shared libraries). >>>>>> >>>>>> However, there is race in two possible places. >>>>>> >>>>>> 1) multiple writers truncate the same page cache concurrently; >>>>>> 2) collapse_file rolls back when writer truncates the page cache; >>>>> >>>>> As I've said before, the bug here is that somehow there is a writable fd >>>>> to a file with THPs. That's what we need to track down and fix. >>>> Hi, Matthew >>>> I am not sure get your means. We know “mm, thp: relax the VM_DENYWRITE constraint on file-backed THPs" >>>> Introduced file-backed THPs for DSO. It is possible {very rarely} for DSO to be opened in writeable way. >>>> >>>> ... >>>> >>>>> https://lore.kernel.org/linux-mm/YUdL3lFLFHzC80Wt@casper.infradead.org/ >>>> All in all, what you mean is that we should solve this race at the source? >>> >>> Matthew is being pretty clear here: we shouldn't be permitting >>> userspace to get a writeable fd for a thp-backed file. >>> >>> Why are we permitting the DSO to be opened writeably? If there's a >>> legitimate case for doing this then presumably "mm, thp: relax the >> There is a use case to stress file-backed THP within attachment. >> I test this case in a system which has enabled CONFIG_READ_ONLY_THP_FOR_FS: >> >> $ gcc -Wall -g -o stress_madvise_dso stress_madvise_dso.c >> $ ulimit -s unlimited >> $ ./stress_madvise_dso 10000 >> >> the meaning of above parameters: >> 10000: the max test time; >> : the DSO that will been mapped into file-backed THP by >> madvise. It recommended that the text segment of DSO to be tested is >> greater than 2M. >> >> The crash will been triggered at once in the latest kernel. And this >> case also can used to trigger the bug that mentioned in our another patch. > > Hmm.. I am not able to use the repro program to crash the system. Not > sure what I did wrong. > Hi I have tried to check my test case again. Can you make sure the DSO that you test have THP mapping? If you are willing to try again, I can send my libtest.c which is used to test by myself (actually, it shouldn't be target DSO problem). Thanks very much! > OTOH, does it make sense to block writes within khugepaged, like: > > diff --git i/mm/khugepaged.c w/mm/khugepaged.c > index 045cc579f724e..ad7c41ec15027 100644 > --- i/mm/khugepaged.c > +++ w/mm/khugepaged.c > @@ -51,6 +51,7 @@ enum scan_result { > SCAN_CGROUP_CHARGE_FAIL, > SCAN_TRUNCATED, > SCAN_PAGE_HAS_PRIVATE, > + SCAN_BUSY_WRITE, > }; > > #define CREATE_TRACE_POINTS > @@ -1652,6 +1653,11 @@ static void collapse_file(struct mm_struct *mm, > /* Only allocate from the target node */ > gfp = alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; > > + if (deny_write_access(file)) { > + result = SCAN_BUSY_WRITE; > + return; > + } > + This can indeed avoid some possible races from source. But, I am thinking about whether this will lead to DDoS attack? I remember the reason of DSO has ignored MAP_DENYWRITE in kernel is that DDoS attack. In addition, 'deny_write_access' will change the behavior, such as user will get 'Text file busy' during collapse_file. I am not sure whether the behavior changing is acceptable in user space. If it is acceptable, I am very willing to fix the races like your way. Thanks! > new_page = khugepaged_alloc_page(hpage, gfp, node); > if (!new_page) { > result = SCAN_ALLOC_HUGE_PAGE_FAIL; > @@ -1863,19 +1869,6 @@ static void collapse_file(struct mm_struct *mm, > else { > __mod_lruvec_page_state(new_page, NR_FILE_THPS, nr); > filemap_nr_thps_inc(mapping); > - /* > - * Paired with smp_mb() in do_dentry_open() to ensure > - * i_writecount is up to date and the update to nr_thps is > - * visible. Ensures the page cache will be truncated if the > - * file is opened writable. > - */ > - smp_mb(); > - if (inode_is_open_for_write(mapping->host)) { > - result = SCAN_FAIL; > - __mod_lruvec_page_state(new_page, NR_FILE_THPS, -nr); > - filemap_nr_thps_dec(mapping); > - goto xa_locked; > - } > } > > if (nr_none) { > @@ -1976,6 +1969,7 @@ static void collapse_file(struct mm_struct *mm, > VM_BUG_ON(!list_empty(&pagelist)); > if (!IS_ERR_OR_NULL(*hpage)) > mem_cgroup_uncharge(*hpage); > + allow_write_access(file); > /* TODO: tracepoints */ > } >