From: "Kirill A. Shutemov" <kirill@shutemov.name>
To: Keno Fischer <keno@juliacomputing.com>
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
torvalds@linux-foundation.org, gthelen@google.com,
npiggin@gmail.com, w@1wt.eu, oleg@redhat.com,
keescook@chromium.org, luto@kernel.org, mhocko@suse.com,
hughd@google.com
Subject: Re: [PATCH v2] mm: Respect FOLL_FORCE/FOLL_COW for thp
Date: Fri, 6 Jan 2017 11:18:44 +0300 [thread overview]
Message-ID: <20170106081844.GA4454@node.shutemov.name> (raw)
In-Reply-To: <20170106015025.GA38411@juliacomputing.com>
On Thu, Jan 05, 2017 at 08:50:25PM -0500, Keno Fischer wrote:
> In 19be0eaff ("mm: remove gup_flags FOLL_WRITE games from __get_user_pages()"),
> the mm code was changed from unsetting FOLL_WRITE after a COW was resolved to
> setting the (newly introduced) FOLL_COW instead. Simultaneously, the check in
> gup.c was updated to still allow writes with FOLL_FORCE set if FOLL_COW had
> also been set. However, a similar check in huge_memory.c was forgotten. As a
> result, remote memory writes to ro regions of memory backed by transparent huge
> pages cause an infinite loop in the kernel (handle_mm_fault sets FOLL_COW and
> returns 0 causing a retry, but follow_trans_huge_pmd bails out immidiately
> because `(flags & FOLL_WRITE) && !pmd_write(*pmd)` is true. While in this
> state the process is stil SIGKILLable, but little else works (e.g. no ptrace
> attach, no other signals). This is easily reproduced with the following
> code (assuming thp are set to always):
>
> #include <assert.h>
> #include <fcntl.h>
> #include <stdint.h>
> #include <stdio.h>
> #include <string.h>
> #include <sys/mman.h>
> #include <sys/stat.h>
> #include <sys/types.h>
> #include <sys/wait.h>
> #include <unistd.h>
>
> #define TEST_SIZE 5 * 1024 * 1024
>
> int main(void) {
> int status;
> pid_t child;
> int fd = open("/proc/self/mem", O_RDWR);
> void *addr = mmap(NULL, TEST_SIZE, PROT_READ,
> MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
> assert(addr != MAP_FAILED);
> pid_t parent_pid = getpid();
> if ((child = fork()) == 0) {
> void *addr2 = mmap(NULL, TEST_SIZE, PROT_READ | PROT_WRITE,
> MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
> assert(addr2 != MAP_FAILED);
> memset(addr2, 'a', TEST_SIZE);
> pwrite(fd, addr2, TEST_SIZE, (uintptr_t)addr);
> return 0;
> }
> assert(child == waitpid(child, &status, 0));
> assert(WIFEXITED(status) && WEXITSTATUS(status) == 0);
> return 0;
> }
>
> Fix this by updating follow_trans_huge_pmd in huge_memory.c analogously to
> the update in gup.c in the original commit. The same pattern exists in
> follow_devmap_pmd. However, we should not be able to reach that check
> with FOLL_COW set, so add WARN_ONCE to make sure we notice if we ever
> do.
>
> Signed-off-by: Keno Fischer <keno@juliacomputing.com>
Cc: stable@ ?
Acke-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
--
Kirill A. Shutemov
next prev parent reply other threads:[~2017-01-06 8:27 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-06 1:50 [PATCH v2] mm: Respect FOLL_FORCE/FOLL_COW for thp Keno Fischer
2017-01-06 8:18 ` Kirill A. Shutemov [this message]
2017-01-10 9:29 ` Michal Hocko
2017-01-10 12:20 ` Kirill A. Shutemov
2017-01-10 12:26 ` Michal Hocko
2017-01-11 1:11 ` David Rientjes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170106081844.GA4454@node.shutemov.name \
--to=kirill@shutemov.name \
--cc=gthelen@google.com \
--cc=hughd@google.com \
--cc=keescook@chromium.org \
--cc=keno@juliacomputing.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mhocko@suse.com \
--cc=npiggin@gmail.com \
--cc=oleg@redhat.com \
--cc=torvalds@linux-foundation.org \
--cc=w@1wt.eu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).