From: Mel Gorman <mel@csn.ul.ie>
To: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Minchan Kim <minchan.kim@gmail.com>,
KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>,
Andrew Morton <akpm@linux-foundation.org>,
Andrea Arcangeli <aarcange@redhat.com>,
Christoph Lameter <cl@linux-foundation.org>,
Adam Litke <agl@us.ibm.com>, Avi Kivity <avi@redhat.com>,
David Rientjes <rientjes@google.com>,
Rik van Riel <riel@redhat.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org
Subject: Re: [PATCH 02/11] mm,migration: Do not try to migrate unmapped anonymous pages
Date: Wed, 17 Mar 2010 11:51:34 +0000 [thread overview]
Message-ID: <20100317115133.GG12388@csn.ul.ie> (raw)
In-Reply-To: <20100317104734.4C8E.A69D9226@jp.fujitsu.com>
On Wed, Mar 17, 2010 at 11:03:05AM +0900, KOSAKI Motohiro wrote:
> > mm,migration: Do not try to migrate unmapped anonymous pages
> >
> > rmap_walk_anon() was triggering errors in memory compaction that look like
> > use-after-free errors. The problem is that between the page being isolated
> > from the LRU and rcu_read_lock() being taken, the mapcount of the page
> > dropped to 0 and the anon_vma gets freed. This can happen during memory
> > compaction if pages being migrated belong to a process that exits before
> > migration completes. Hence, the use-after-free race looks like
> >
> > 1. Page isolated for migration
> > 2. Process exits
> > 3. page_mapcount(page) drops to zero so anon_vma was no longer reliable
> > 4. unmap_and_move() takes the rcu_lock but the anon_vma is already garbage
> > 4. call try_to_unmap, looks up tha anon_vma and "locks" it but the lock
> > is garbage.
> >
> > This patch checks the mapcount after the rcu lock is taken. If the
> > mapcount is zero, the anon_vma is assumed to be freed and no further
> > action is taken.
> >
> > Signed-off-by: Mel Gorman <mel@csn.ul.ie>
> > Acked-by: Rik van Riel <riel@redhat.com>
> > ---
> > mm/migrate.c | 13 +++++++++++++
> > 1 files changed, 13 insertions(+), 0 deletions(-)
> >
> > diff --git a/mm/migrate.c b/mm/migrate.c
> > index 98eaaf2..6eb1efe 100644
> > --- a/mm/migrate.c
> > +++ b/mm/migrate.c
> > @@ -603,6 +603,19 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
> > */
> > if (PageAnon(page)) {
> > rcu_read_lock();
> > +
> > + /*
> > + * If the page has no mappings any more, just bail. An
> > + * unmapped anon page is likely to be freed soon but worse,
> > + * it's possible its anon_vma disappeared between when
> > + * the page was isolated and when we reached here while
> > + * the RCU lock was not held
> > + */
> > + if (!page_mapcount(page)) {
> > + rcu_read_unlock();
> > + goto uncharge;
> > + }
>
> I haven't understand what prevent this check. Why don't we need following scenario?
>
> 1. Page isolated for migration
> 2. Passed this if (!page_mapcount(page)) check
> 3. Process exits
> 4. page_mapcount(page) drops to zero so anon_vma was no longer reliable
>
>
> Traditionally, page migration logic is, it can touch garbarge of anon_vma, but
> SLAB_DESTROY_BY_RCU prevent any disaster. Is this broken concept?
>
The check is made within the RCU read lock. If the count is positive at
that point but goes to zero due to a process exiting, the anon_vma will
still be valid until rcu_read_unlock() is called.
--
Mel Gorman
Part-time Phd Student Linux Technology Center
University of Limerick IBM Dublin Software Lab
next prev parent reply other threads:[~2010-03-17 11:51 UTC|newest]
Thread overview: 109+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-12 16:41 [PATCH 0/11] Memory Compaction v4 Mel Gorman
2010-03-12 16:41 ` [PATCH 01/11] mm,migration: Take a reference to the anon_vma before migrating Mel Gorman
2010-03-14 15:01 ` Minchan Kim
2010-03-15 5:06 ` KAMEZAWA Hiroyuki
2010-03-17 1:44 ` KOSAKI Motohiro
2010-03-17 11:45 ` Mel Gorman
2010-03-17 16:38 ` Christoph Lameter
2010-03-18 11:12 ` Mel Gorman
2010-03-18 16:31 ` Christoph Lameter
2010-03-12 16:41 ` [PATCH 02/11] mm,migration: Do not try to migrate unmapped anonymous pages Mel Gorman
2010-03-15 0:28 ` Minchan Kim
2010-03-15 5:34 ` KAMEZAWA Hiroyuki
2010-03-15 6:28 ` Minchan Kim
2010-03-15 6:44 ` KAMEZAWA Hiroyuki
2010-03-15 7:09 ` KAMEZAWA Hiroyuki
2010-03-15 13:48 ` Minchan Kim
2010-03-15 7:11 ` Minchan Kim
2010-03-15 11:28 ` Mel Gorman
2010-03-15 12:48 ` Minchan Kim
2010-03-15 14:21 ` Mel Gorman
2010-03-15 14:33 ` Minchan Kim
2010-03-15 23:49 ` KAMEZAWA Hiroyuki
2010-03-17 2:12 ` KAMEZAWA Hiroyuki
2010-03-17 3:00 ` Minchan Kim
2010-03-17 3:15 ` KAMEZAWA Hiroyuki
2010-03-17 4:15 ` Minchan Kim
2010-03-17 4:19 ` KAMEZAWA Hiroyuki
2010-03-17 16:41 ` Christoph Lameter
2010-03-18 0:30 ` KAMEZAWA Hiroyuki
2010-03-17 12:07 ` Mel Gorman
2010-03-17 2:03 ` KOSAKI Motohiro
2010-03-17 11:51 ` Mel Gorman [this message]
2010-03-18 0:48 ` KOSAKI Motohiro
2010-03-18 11:14 ` Mel Gorman
2010-03-19 6:21 ` KOSAKI Motohiro
2010-03-19 8:59 ` Mel Gorman
2010-03-25 2:49 ` KOSAKI Motohiro
2010-03-25 8:32 ` Mel Gorman
2010-03-25 8:56 ` KOSAKI Motohiro
2010-03-25 9:18 ` Mel Gorman
2010-03-25 9:02 ` KAMEZAWA Hiroyuki
2010-03-25 9:09 ` KOSAKI Motohiro
2010-03-25 9:08 ` KAMEZAWA Hiroyuki
2010-03-25 9:21 ` Mel Gorman
2010-03-25 9:41 ` KAMEZAWA Hiroyuki
2010-03-25 9:59 ` KOSAKI Motohiro
2010-03-25 10:12 ` KAMEZAWA Hiroyuki
2010-03-25 13:39 ` Mel Gorman
2010-03-26 3:07 ` KOSAKI Motohiro
2010-03-26 13:49 ` Mel Gorman
2010-03-25 15:29 ` Minchan Kim
2010-03-26 0:58 ` KAMEZAWA Hiroyuki
2010-03-26 1:39 ` Minchan Kim
2010-03-25 14:35 ` Christoph Lameter
2010-03-25 16:16 ` Minchan Kim
2010-03-12 16:41 ` [PATCH 03/11] mm: Share the anon_vma ref counts between KSM and page migration Mel Gorman
2010-03-12 17:14 ` Rik van Riel
2010-03-15 5:35 ` KAMEZAWA Hiroyuki
2010-03-17 2:06 ` KOSAKI Motohiro
2010-03-12 16:41 ` [PATCH 04/11] Allow CONFIG_MIGRATION to be set without CONFIG_NUMA or memory hot-remove Mel Gorman
2010-03-17 2:28 ` KOSAKI Motohiro
2010-03-17 11:32 ` Mel Gorman
2010-03-17 16:37 ` Christoph Lameter
2010-03-17 23:56 ` KOSAKI Motohiro
2010-03-18 11:24 ` Mel Gorman
2010-03-19 6:21 ` KOSAKI Motohiro
2010-03-19 10:16 ` Mel Gorman
2010-03-25 3:28 ` KOSAKI Motohiro
2010-03-12 16:41 ` [PATCH 05/11] Export unusable free space index via /proc/unusable_index Mel Gorman
2010-03-15 5:41 ` KAMEZAWA Hiroyuki
2010-03-15 9:48 ` Mel Gorman
2010-03-17 2:42 ` KOSAKI Motohiro
2010-03-12 16:41 ` [PATCH 06/11] Export fragmentation index via /proc/extfrag_index Mel Gorman
2010-03-17 2:49 ` KOSAKI Motohiro
2010-03-17 11:33 ` Mel Gorman
2010-03-23 0:22 ` KOSAKI Motohiro
2010-03-23 12:03 ` Mel Gorman
2010-03-25 2:47 ` KOSAKI Motohiro
2010-03-25 8:47 ` Mel Gorman
2010-03-25 11:20 ` KOSAKI Motohiro
2010-03-25 14:11 ` Mel Gorman
2010-03-26 3:10 ` KOSAKI Motohiro
2010-03-12 16:41 ` [PATCH 07/11] Memory compaction core Mel Gorman
2010-03-15 13:44 ` Minchan Kim
2010-03-15 14:41 ` Mel Gorman
2010-03-17 10:31 ` KOSAKI Motohiro
2010-03-17 11:40 ` Mel Gorman
2010-03-18 2:35 ` KOSAKI Motohiro
2010-03-18 11:43 ` Mel Gorman
2010-03-19 6:21 ` KOSAKI Motohiro
2010-03-18 17:08 ` Mel Gorman
2010-03-12 16:41 ` [PATCH 08/11] Add /proc trigger for memory compaction Mel Gorman
2010-03-17 3:18 ` KOSAKI Motohiro
2010-03-12 16:41 ` [PATCH 09/11] Add /sys trigger for per-node " Mel Gorman
2010-03-17 3:18 ` KOSAKI Motohiro
2010-03-12 16:41 ` [PATCH 10/11] Direct compact when a high-order allocation fails Mel Gorman
2010-03-16 2:47 ` Minchan Kim
2010-03-19 6:21 ` KOSAKI Motohiro
2010-03-19 6:31 ` KOSAKI Motohiro
2010-03-19 10:10 ` Mel Gorman
2010-03-25 11:22 ` KOSAKI Motohiro
2010-03-19 10:09 ` Mel Gorman
2010-03-25 11:08 ` KOSAKI Motohiro
2010-03-25 15:11 ` Mel Gorman
2010-03-26 6:01 ` KOSAKI Motohiro
2010-03-12 16:41 ` [PATCH 11/11] Do not compact within a preferred zone after a compaction failure Mel Gorman
2010-03-23 12:25 [PATCH 0/11] Memory Compaction v5 Mel Gorman
2010-03-23 12:25 ` [PATCH 02/11] mm,migration: Do not try to migrate unmapped anonymous pages Mel Gorman
2010-03-23 17:22 ` Christoph Lameter
2010-03-23 18:04 ` Mel Gorman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100317115133.GG12388@csn.ul.ie \
--to=mel@csn.ul.ie \
--cc=aarcange@redhat.com \
--cc=agl@us.ibm.com \
--cc=akpm@linux-foundation.org \
--cc=avi@redhat.com \
--cc=cl@linux-foundation.org \
--cc=kamezawa.hiroyu@jp.fujitsu.com \
--cc=kosaki.motohiro@jp.fujitsu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=minchan.kim@gmail.com \
--cc=riel@redhat.com \
--cc=rientjes@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).