From: David Hildenbrand <david@redhat.com>
To: Yang Shi <shy828301@gmail.com>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Hugh Dickins <hughd@google.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
David Rientjes <rientjes@google.com>,
Shakeel Butt <shakeelb@google.com>,
John Hubbard <jhubbard@nvidia.com>,
Jason Gunthorpe <jgg@nvidia.com>,
Mike Kravetz <mike.kravetz@oracle.com>,
Mike Rapoport <rppt@linux.ibm.com>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Matthew Wilcox <willy@infradead.org>,
Vlastimil Babka <vbabka@suse.cz>, Jann Horn <jannh@google.com>,
Michal Hocko <mhocko@kernel.org>, Nadav Amit <namit@vmware.com>,
Rik van Riel <riel@surriel.com>, Roman Gushchin <guro@fb.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Peter Xu <peterx@redhat.com>, Donald Dutile <ddutile@redhat.com>,
Christoph Hellwig <hch@lst.de>, Oleg Nesterov <oleg@redhat.com>,
Jan Kara <jack@suse.cz>, Liang Zhang <zhangliang5@huawei.com>,
Linux MM <linux-mm@kvack.org>
Subject: Re: [PATCH RFC v2 5/9] mm/huge_memory: streamline COW logic in do_huge_pmd_wp_page()
Date: Thu, 27 Jan 2022 09:14:07 +0100 [thread overview]
Message-ID: <1d1d4b01-961f-d7e7-491c-a482bdd3fded@redhat.com> (raw)
In-Reply-To: <CAHbLzkqmxSTkh4WOQr8xzzMO94Gr8GuqH8Vn4T5q8rW7gkabYQ@mail.gmail.com>
On 26.01.22 21:36, Yang Shi wrote:
> On Wed, Jan 26, 2022 at 2:00 AM David Hildenbrand <david@redhat.com> wrote:
>>
>> We currently have a different COW logic for anon THP than we have for
>> ordinary anon pages in do_wp_page(): the effect is that the issue reported
>> in CVE-2020-29374 is currently still possible for anon THP: an unintended
>> information leak from the parent to the child.
>>
>> Let's apply the same logic (page_count() == 1), with similar
>> optimizations to remove additional references first as we really want to
>> avoid PTE-mapping the THP and copying individual pages best we can.
>>
>> If we end up with a page that has page_count() != 1, we'll have to PTE-map
>> the THP and fallback to do_wp_page(), which will always copy the page.
>>
>> Note that KSM does not apply to THP.
>>
>> I. Interaction with the swapcache and writeback
>>
>> While a THP is in the swapcache, the swapcache holds one reference on each
>> subpage of the THP. So with PageSwapCache() set, we expect as many
>> additional references as we have subpages. If we manage to remove the
>> THP from the swapcache, all these references will be gone.
>>
>> Usually, a THP is not split when entered into the swapcache and stays a
>> compound page. However, try_to_unmap() will PTE-map the THP and use PTE
>> swap entries. There are no PMD swap entries for that purpose, consequently,
>> we always only swapin subpages into PTEs.
>>
>> Removing a page from the swapcache can fail either when there are remaining
>> swap entries (in which case COW is the right thing to do) or if the page is
>> currently under writeback.
>>
>> Having a locked, R/O PMD-mapped THP that is in the swapcache seems to be
>> possible only in corner cases, for example, if try_to_unmap() failed
>> after adding the page to the swapcache. However, it's comparatively easy to
>> handle.
>>
>> As we have to fully unmap a THP before starting writeback, and swapin is
>> always done on the PTE level, we shouldn't find a R/O PMD-mapped THP in the
>> swapcache that is under writeback. This should at least leave writeback
>> out of the picture.
>>
>> II. Interaction with GUP references
>>
>> Having a R/O PMD-mapped THP with GUP references (i.e., R/O references)
>> will result in PTE-mapping the THP on a write fault. Similar to ordinary
>> anon pages, do_wp_page() will have to copy sub-pages and result in a
>> disconnect between the GUP references and the pages actually mapped into
>> the page tables. To improve the situation in the future, we'll need
>> additional handling to mark anonymous pages as definitely exclusive to a
>> single process, only allow GUP pins on exclusive anon pages, and
>> disallow sharing of exclusive anon pages with GUP pins e.g., during
>> fork().
>>
>> III. Interaction with references from LRU pagevecs
>>
>> Similar to ordinary anon pages, we can have LRU pagevecs referencing our
>> THP. Reliably removing such references requires draining LRU pagevecs on
>> all CPUs -- lru_add_drain_all() -- a possibly expensive operation that can
>> sleep. For now, similar do do_wp_page(), let's conditionally drain the
>> local LRU pagevecs only if we detect !PageLRU().
>>
>> IV. Interaction with speculative/temporary references
>>
>> Similar to ordinary anon pages, other speculative/temporary references on
>> the THP, for example, from the pagecache or page migration code, will
>> disallow exclusive reuse of the page. We'll have to PTE-map the THP.
>>
>> Signed-off-by: David Hildenbrand <david@redhat.com>
>> ---
>> mm/huge_memory.c | 19 +++++++++++++++----
>> 1 file changed, 15 insertions(+), 4 deletions(-)
>>
>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>> index 406a3c28c026..b6ba88a98266 100644
>> --- a/mm/huge_memory.c
>> +++ b/mm/huge_memory.c
>> @@ -1286,6 +1286,7 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf)
>> struct page *page;
>> unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
>> pmd_t orig_pmd = vmf->orig_pmd;
>> + int swapcache_refs = 0;
>>
>> vmf->ptl = pmd_lockptr(vma->vm_mm, vmf->pmd);
>> VM_BUG_ON_VMA(!vma->anon_vma, vma);
>> @@ -1303,7 +1304,6 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf)
>> page = pmd_page(orig_pmd);
>> VM_BUG_ON_PAGE(!PageHead(page), page);
>>
>> - /* Lock page for reuse_swap_page() */
>> if (!trylock_page(page)) {
>> get_page(page);
>> spin_unlock(vmf->ptl);
>> @@ -1319,10 +1319,20 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf)
>> }
>>
>> /*
>> - * We can only reuse the page if nobody else maps the huge page or it's
>> - * part.
>> + * See do_wp_page(): we can only map the page writable if there are
>> + * no additional references.
>> */
>> - if (reuse_swap_page(page)) {
>> + if (PageSwapCache(page))
>> + swapcache_refs = thp_nr_pages(page);
>> + if (page_count(page) > 1 + swapcache_refs + !PageLRU(page))
>> + goto unlock_fallback;
>> + if (!PageLRU(page))
>> + lru_add_drain();
>
> IMHO, draining lru doesn't help out too much for THP since THP will be
> drained to LRU immediately once it is added into pagevec.
Oh, thanks, I think you're right. The interesting bit is
static bool pagevec_add_and_need_flush(struct pagevec *pvec, struct page
*page)
{
bool ret = false;
if (!pagevec_add(pvec, page) || PageCompound(page) ||
lru_cache_disabled())
ret = true;
return ret;
}
Which indeed drains after adding it to the pagevec.
Will adjust the patch and update the description/comment accordingly,
thanks!
--
Thanks,
David / dhildenb
next prev parent reply other threads:[~2022-01-27 8:14 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-26 9:55 [PATCH RFC v2 0/9] mm: COW fixes part 1: fix the COW security issue for THP and swap David Hildenbrand
2022-01-26 9:55 ` [PATCH RFC v2 1/9] mm: optimize do_wp_page() for exclusive pages in the swapcache David Hildenbrand
2022-01-26 14:25 ` Matthew Wilcox
2022-01-28 12:53 ` Vlastimil Babka
2022-01-28 13:44 ` David Hildenbrand
2022-01-26 9:55 ` [PATCH RFC v2 2/9] mm: optimize do_wp_page() for fresh pages in local LRU pagevecs David Hildenbrand
2022-01-26 14:31 ` Matthew Wilcox
2022-01-26 14:36 ` David Hildenbrand
2022-01-26 9:55 ` [PATCH RFC v2 3/9] mm: slightly clarify KSM logic in do_swap_page() David Hildenbrand
2022-01-26 9:55 ` [PATCH RFC v2 4/9] mm: streamline COW " David Hildenbrand
2022-01-26 9:55 ` [PATCH RFC v2 5/9] mm/huge_memory: streamline COW logic in do_huge_pmd_wp_page() David Hildenbrand
2022-01-26 20:36 ` Yang Shi
2022-01-27 8:14 ` David Hildenbrand [this message]
2022-01-26 9:55 ` [PATCH RFC v2 6/9] mm/khugepaged: remove reuse_swap_page() usage David Hildenbrand
2022-01-27 21:23 ` Yang Shi
2022-01-28 8:41 ` David Hildenbrand
2022-01-28 17:10 ` Yang Shi
2022-01-26 9:55 ` [PATCH RFC v2 7/9] mm/swapfile: remove reuse_swap_page() David Hildenbrand
2022-01-26 9:55 ` [PATCH RFC v2 8/9] mm/huge_memory: remove stale page_trans_huge_mapcount() David Hildenbrand
2022-01-26 9:55 ` [PATCH RFC v2 9/9] mm/huge_memory: remove stale locking logic from __split_huge_pmd() David Hildenbrand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1d1d4b01-961f-d7e7-491c-a482bdd3fded@redhat.com \
--to=david@redhat.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=ddutile@redhat.com \
--cc=guro@fb.com \
--cc=hch@lst.de \
--cc=hughd@google.com \
--cc=jack@suse.cz \
--cc=jannh@google.com \
--cc=jgg@nvidia.com \
--cc=jhubbard@nvidia.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@kernel.org \
--cc=mike.kravetz@oracle.com \
--cc=namit@vmware.com \
--cc=oleg@redhat.com \
--cc=peterx@redhat.com \
--cc=riel@surriel.com \
--cc=rientjes@google.com \
--cc=rppt@linux.ibm.com \
--cc=shakeelb@google.com \
--cc=shy828301@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=vbabka@suse.cz \
--cc=willy@infradead.org \
--cc=zhangliang5@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).