From: Michal Hocko <mhocko@kernel.org>
To: guoxuenan <guoxuenan@huawei.com>
Cc: akpm@linux-foundation.org, minchan@kernel.org,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
rppt@linux.vnet.ibm.com, hillf.zj@alibaba-inc.com, shli@fb.com,
aarcange@redhat.com, mgorman@techsingularity.net,
kirill.shutemov@linux.intel.com, rientjes@google.com,
khandual@linux.vnet.ibm.com, riel@redhat.com
Subject: Re: [PATCH] mm,madvise: bugfix of madvise systemcall infinite loop under special circumstances.
Date: Fri, 24 Nov 2017 09:05:07 +0100 [thread overview]
Message-ID: <20171124080507.u76g634hucoxmpov@dhcp22.suse.cz> (raw)
In-Reply-To: <20171124022757.4991-1-guoxuenan@huawei.com>
On Fri 24-11-17 10:27:57, guoxuenan wrote:
> From: chenjie <chenjie6@huawei.com>
>
> The madvise() system call supported a set of "conventional" advice values,
> the MADV_WILLNEED parameter will trigger an infinite loop under direct
> access mode(DAX). In DAX mode, the function madvise_vma() will return
> directly without updating the pointer [prev].
>
> For example:
> Special circumstances:
> 1、init [ start < vam->vm_start < vam->vm_end < end ]
> 2、madvise_vma() using MADV_WILLNEED parameter ;
> madvise_vma() -> madvise_willneed() -> return 0 && without updating [prev]
>
> =======================================================================
> in Function SYSCALL_DEFINE3(madvise,...)
>
> for (;;)
> {
> //[first loop: start = vam->vm_start < vam->vm_end <end ];
> update [start = vma->vm_start | end ]
>
> con0: if (start >= end) //false always;
> goto out;
> tmp = vma->vm_end;
>
> //do not update [prev] and always return 0;
> error = madvise_willneed();
>
> con1: if (error) //false always;
> goto out;
>
> //[ vam->vm_start < start = vam->vm_end <end ]
> update [start = tmp ]
>
> con2: if (start >= end) //false always ;
> goto out;
>
> //because of pointer [prev] did not change,[vma] keep as it was;
> update [ vma = prev->vm_next ]
> }
>
> =======================================================================
> After the first cycle ;it will always keep
> [ vam->vm_start < start = vam->vm_end < end ].
> since Circulation exit conditions (con{0,1,2}) will never meet ,the
> program stuck in infinite loop.
Are you sure? Have you tested this? I might be missing something because
madvise code is a bit of a mess but AFAICS prev pointer (updated or not)
will allow to move advance
if (prev)
vma = prev->vm_next;
else /* madvise_remove dropped mmap_sem */
vma = find_vma(current->mm, start);
note that start is vma->vm_end and find_vma will find a vma which
vma_end > addr
So either I am missing something or this code has actaully never worked
for DAX, XIP which I find rather suspicious.
> Signed-off-by: chenjie <chenjie6@huawei.com>
> Signed-off-by: guoxuenan <guoxuenan@huawei.com>
> ---
> mm/madvise.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/mm/madvise.c b/mm/madvise.c
> index 21261ff..c355fee 100644
> --- a/mm/madvise.c
> +++ b/mm/madvise.c
> @@ -294,6 +294,7 @@ static long madvise_willneed(struct vm_area_struct *vma,
> #endif
>
> if (IS_DAX(file_inode(file))) {
> + *prev = vma;
> /* no bad return value, but ignore advice */
> return 0;
> }
> --
> 2.9.5
>
--
Michal Hocko
SUSE Labs
next prev parent reply other threads:[~2017-11-24 8:05 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-24 2:27 [PATCH] mm,madvise: bugfix of madvise systemcall infinite loop under special circumstances guoxuenan
2017-11-24 8:05 ` Michal Hocko [this message]
[not found] ` <829af987-4d65-382c-dbd4-0c81222ebb51@huawei.com>
[not found] ` <20171124130803.hafb3zbhy7gdqkvi@dhcp22.suse.cz>
2017-11-25 1:52 ` 郭雪楠
2017-11-27 2:54 ` 郭雪楠
2017-11-27 7:59 ` Michal Hocko
2017-11-27 11:53 guoxuenan
2017-11-27 11:58 ` Michal Hocko
2017-11-27 12:28 ` guoxuenan
2017-11-27 12:42 ` Mike Rapoport
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171124080507.u76g634hucoxmpov@dhcp22.suse.cz \
--to=mhocko@kernel.org \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=guoxuenan@huawei.com \
--cc=hillf.zj@alibaba-inc.com \
--cc=khandual@linux.vnet.ibm.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mgorman@techsingularity.net \
--cc=minchan@kernel.org \
--cc=riel@redhat.com \
--cc=rientjes@google.com \
--cc=rppt@linux.vnet.ibm.com \
--cc=shli@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).