From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D83F3C433DB for ; Wed, 13 Jan 2021 03:31:29 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 106132312E for ; Wed, 13 Jan 2021 03:31:28 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 106132312E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0F1A16B0127; Tue, 12 Jan 2021 22:31:28 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 07A2D6B0129; Tue, 12 Jan 2021 22:31:28 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E5D4E6B012A; Tue, 12 Jan 2021 22:31:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0098.hostedemail.com [216.40.44.98]) by kanga.kvack.org (Postfix) with ESMTP id CAD196B0127 for ; Tue, 12 Jan 2021 22:31:27 -0500 (EST) Received: from smtpin11.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 992F4824556B for ; Wed, 13 Jan 2021 03:31:27 +0000 (UTC) X-FDA: 77699326614.11.shake05_170a8c92751a Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin11.hostedemail.com (Postfix) with ESMTP id 7A712180F8B82 for ; Wed, 13 Jan 2021 03:31:27 +0000 (UTC) X-HE-Tag: shake05_170a8c92751a X-Filterd-Recvd-Size: 6819 Received: from mail-lj1-f179.google.com (mail-lj1-f179.google.com [209.85.208.179]) by imf31.hostedemail.com (Postfix) with ESMTP for ; Wed, 13 Jan 2021 03:31:26 +0000 (UTC) Received: by mail-lj1-f179.google.com with SMTP id u21so981457lja.0 for ; Tue, 12 Jan 2021 19:31:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CH+xsIRM+IV0uinVWZZSPxYmWLGJmAD6nwl0cbAWTi4=; b=Vgjl7SKuukjWFtnm7i3ijVQrIXWvFzxtoe/B4OnSHO3sGSWu7IPVs4gEMtptVVrJH9 rGL5Gzd9pD0dU+kkbFRXafvsqm107Yx5JFtNWGTnl6xau+f57pdALjQESjacpWyhmt57 e8wmN5OnfVL4Iv/iOEQ9nCjD9Yb7schG5pB+E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CH+xsIRM+IV0uinVWZZSPxYmWLGJmAD6nwl0cbAWTi4=; b=HVtE+QpYu9fErKslGZIFJElJfterxLID4n0Ae4K4Y1Fe+iDS5Xd8lSiaV7q9r+xIai U/6P3IF0qmgIt68oO/5he9ja66w4w9Y+1TahBZF0lVEiXmLGuPgeM7bX56buTaOb3GMu lKHjSWHVjAWlOBDgvPyKS9M+lQfTSYEvuSXHAKm8HTHfLJgjriMtCLXef6c6VXkqXVc/ oKN5+fVxmW6L/0Fjv70lJHiz1lDz4AYLmc0yOvaOt1o4H5bHH6xyK8WX9hN5B7S5/tH9 Oseu3rcOc4cCO7bq++ZUFZ4HDXaB76zt3q0NPiAdFL4bNaw1DiYu0GM2+IkLibSk9O3K LkVA== X-Gm-Message-State: AOAM531yO8Ichjfn5Jts/EKjP+GDEaVtj9jQmU2jh10WwIan+Ra7m7eq LyTbDTM39aNkcO/gWd8jxBTAspZcfCVsyQ== X-Google-Smtp-Source: ABdhPJw8gfCGSH/3+pdfWLJM2GHCRx1D9aD7L+x5HYH2WqJxjItuD4Ajm5cKjmDQVGt/UhAUr1MlVw== X-Received: by 2002:a2e:7011:: with SMTP id l17mr7259ljc.181.1610508685017; Tue, 12 Jan 2021 19:31:25 -0800 (PST) Received: from mail-lj1-f170.google.com (mail-lj1-f170.google.com. [209.85.208.170]) by smtp.gmail.com with ESMTPSA id c5sm64484lfh.160.2021.01.12.19.31.23 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 12 Jan 2021 19:31:24 -0800 (PST) Received: by mail-lj1-f170.google.com with SMTP id u21so981401lja.0 for ; Tue, 12 Jan 2021 19:31:23 -0800 (PST) X-Received: by 2002:a2e:b4af:: with SMTP id q15mr1030700ljm.507.1610508683314; Tue, 12 Jan 2021 19:31:23 -0800 (PST) MIME-Version: 1.0 References: <20210110004435.26382-1-aarcange@redhat.com> <45806a5a-65c2-67ce-fc92-dc8c2144d766@nvidia.com> <20210113021619.GL35215@casper.infradead.org> In-Reply-To: <20210113021619.GL35215@casper.infradead.org> From: Linus Torvalds Date: Tue, 12 Jan 2021 19:31:07 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH 0/1] mm: restore full accuracy in COW page reuse To: Matthew Wilcox Cc: John Hubbard , Andrea Arcangeli , Andrew Morton , Linux-MM , Linux Kernel Mailing List , Yu Zhao , Andy Lutomirski , Peter Xu , Pavel Emelyanov , Mike Kravetz , Mike Rapoport , Minchan Kim , Will Deacon , Peter Zijlstra , Hugh Dickins , "Kirill A. Shutemov" , Oleg Nesterov , Jann Horn , Kees Cook , Leon Romanovsky , Jason Gunthorpe , Jan Kara , Kirill Tkhai , Nadav Amit , Jens Axboe Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jan 12, 2021 at 6:16 PM Matthew Wilcox wrote: > > The thing about the speculative page cache references is that they can > temporarily bump a refcount on a page which _used_ to be in the page > cache and has now been reallocated as some other kind of page. Oh, and thinking about this made me think we might actually have a serious bug here, and it has nothing what-so-ever to do with COW, GUP, or even the page count itself. It's unlikely enough that I think it's mostly theoretical, but tell me I'm wrong. PLEASE tell me I'm wrong: CPU1 does page_cache_get_speculative under RCU lock CPU2 frees and re-uses the page CPU1 CPU2 ---- ---- page = xas_load(&xas); if (!page_cache_get_speculative(page)) goto repeat; .. succeeds .. remove page from XA release page reuse for something else .. and then re-check .. if (unlikely(page != xas_reload(&xas))) { put_page(page); goto repeat; } ok, the above all looks fine. We got the speculative ref, but then we noticed that its' not valid any more, so we put it again. All good, right? Wrong. What if that "reuse for something else" was actually really quick, and both allocated and released it? That still sounds good, right? Yes, now the "put_page()" will be the one that _actually_ releases the page, but we're still fine, right? Very very wrong. The "reuse for something else" on CPU2 might have gotten not an order-0 page, but a *high-order* page. So it allocated (and then immediately free'd) maybe an order-2 allocation with _four_ pages, and the re-use happened when we had coalesced the buddy pages. But when we release the page on CPU1, we will release just _one_ page, and the other three pages will be lost forever. IOW, we restored the page count perfectly fine, but we screwed up the page sizes and buddy information. Ok, so the above is so unlikely from a timing standpoint that I don't think it ever happens, but I don't see why it couldn't happen in theory. Please somebody tell me I'm missing some clever thing we do to make sure this can actually not happen.. Linus