From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
To: David Rientjes <rientjes@google.com>
Cc: paulmck@linux.vnet.ibm.com, peterz@infradead.org,
akpm@linux-foundation.org, kirill@shutemov.name,
ak@linux.intel.com, mhocko@kernel.org, dave@stgolabs.net,
jack@suse.cz, Matthew Wilcox <willy@infradead.org>,
benh@kernel.crashing.org, mpe@ellerman.id.au, paulus@samba.org,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
hpa@zytor.com, Will Deacon <will.deacon@arm.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Alexei Starovoitov <alexei.starovoitov@gmail.com>,
kemi.wang@intel.com, sergey.senozhatsky.work@gmail.com,
Daniel Jordan <daniel.m.jordan@oracle.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
haren@linux.vnet.ibm.com, khandual@linux.vnet.ibm.com,
npiggin@gmail.com, bsingharora@gmail.com,
Tim Chen <tim.c.chen@linux.intel.com>,
linuxppc-dev@lists.ozlabs.org, x86@kernel.org
Subject: Re: [PATCH v9 08/24] mm: Protect VMA modifications using VMA sequence count
Date: Wed, 28 Mar 2018 18:57:21 +0200 [thread overview]
Message-ID: <8bb04603-f55e-3c46-8f29-a183ba6ef47b@linux.vnet.ibm.com> (raw)
In-Reply-To: <alpine.DEB.2.20.1803271441290.38095@chino.kir.corp.google.com>
On 27/03/2018 23:45, David Rientjes wrote:
> On Tue, 13 Mar 2018, Laurent Dufour wrote:
>
>> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
>> index 65ae54659833..a2d9c87b7b0b 100644
>> --- a/fs/proc/task_mmu.c
>> +++ b/fs/proc/task_mmu.c
>> @@ -1136,8 +1136,11 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
>> goto out_mm;
>> }
>> for (vma = mm->mmap; vma; vma = vma->vm_next) {
>> - vma->vm_flags &= ~VM_SOFTDIRTY;
>> + vm_write_begin(vma);
>> + WRITE_ONCE(vma->vm_flags,
>> + vma->vm_flags & ~VM_SOFTDIRTY);
>> vma_set_page_prot(vma);
>> + vm_write_end(vma);
>> }
>> downgrade_write(&mm->mmap_sem);
>> break;
>> diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
>> index cec550c8468f..b8212ba17695 100644
>> --- a/fs/userfaultfd.c
>> +++ b/fs/userfaultfd.c
>> @@ -659,8 +659,11 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
>>
>> octx = vma->vm_userfaultfd_ctx.ctx;
>> if (!octx || !(octx->features & UFFD_FEATURE_EVENT_FORK)) {
>> + vm_write_begin(vma);
>> vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
>> - vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING);
>> + WRITE_ONCE(vma->vm_flags,
>> + vma->vm_flags & ~(VM_UFFD_WP | VM_UFFD_MISSING));
>> + vm_write_end(vma);
>> return 0;
>> }
>>
>
> In several locations in this patch vm_write_begin(vma) ->
> vm_write_end(vma) is nesting things other than vma->vm_flags,
> vma->vm_policy, etc. I think it's better to do vm_write_end(vma) as soon
> as the members that the seqcount protects are modified. In other words,
> this isn't offering protection for vma->vm_userfaultfd_ctx. There are
> several examples of this in the patch.
That's true in this particular case, and I could change that to not include the
change to vm_userfaultfd_ctx.
This being said, I don't think this will have a major impact, but I'll make a
close review on this patch to be sure there is too large protected part of code.
>> @@ -885,8 +888,10 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
>> vma = prev;
>> else
>> prev = vma;
>> - vma->vm_flags = new_flags;
>> + vm_write_begin(vma);
>> + WRITE_ONCE(vma->vm_flags, new_flags);
>> vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
>> + vm_write_end(vma);
>> }
>> up_write(&mm->mmap_sem);
>> mmput(mm);
>> @@ -1434,8 +1439,10 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
>> * the next vma was merged into the current one and
>> * the current one has not been updated yet.
>> */
>> - vma->vm_flags = new_flags;
>> + vm_write_begin(vma);
>> + WRITE_ONCE(vma->vm_flags, new_flags);
>> vma->vm_userfaultfd_ctx.ctx = ctx;
>> + vm_write_end(vma);
>>
>> skip:
>> prev = vma;
>> @@ -1592,8 +1599,10 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
>> * the next vma was merged into the current one and
>> * the current one has not been updated yet.
>> */
>> - vma->vm_flags = new_flags;
>> + vm_write_begin(vma);
>> + WRITE_ONCE(vma->vm_flags, new_flags);
>> vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
>> + vm_write_end(vma);
>>
>> skip:
>> prev = vma;
>> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
>> index b7e2268dfc9a..32314e9e48dd 100644
>> --- a/mm/khugepaged.c
>> +++ b/mm/khugepaged.c
>> @@ -1006,6 +1006,7 @@ static void collapse_huge_page(struct mm_struct *mm,
>> if (mm_find_pmd(mm, address) != pmd)
>> goto out;
>>
>> + vm_write_begin(vma);
>> anon_vma_lock_write(vma->anon_vma);
>>
>> pte = pte_offset_map(pmd, address);
>> @@ -1041,6 +1042,7 @@ static void collapse_huge_page(struct mm_struct *mm,
>> pmd_populate(mm, pmd, pmd_pgtable(_pmd));
>> spin_unlock(pmd_ptl);
>> anon_vma_unlock_write(vma->anon_vma);
>> + vm_write_end(vma);
>> result = SCAN_FAIL;
>> goto out;
>> }
>> @@ -1075,6 +1077,7 @@ static void collapse_huge_page(struct mm_struct *mm,
>> set_pmd_at(mm, address, pmd, _pmd);
>> update_mmu_cache_pmd(vma, address, pmd);
>> spin_unlock(pmd_ptl);
>> + vm_write_end(vma);
>>
>> *hpage = NULL;
>>
>> diff --git a/mm/madvise.c b/mm/madvise.c
>> index 4d3c922ea1a1..e328f7ab5942 100644
>> --- a/mm/madvise.c
>> +++ b/mm/madvise.c
>> @@ -184,7 +184,9 @@ static long madvise_behavior(struct vm_area_struct *vma,
>> /*
>> * vm_flags is protected by the mmap_sem held in write mode.
>> */
>> - vma->vm_flags = new_flags;
>> + vm_write_begin(vma);
>> + WRITE_ONCE(vma->vm_flags, new_flags);
>> + vm_write_end(vma);
>> out:
>> return error;
>> }
>> @@ -450,9 +452,11 @@ static void madvise_free_page_range(struct mmu_gather *tlb,
>> .private = tlb,
>> };
>>
>> + vm_write_begin(vma);
>> tlb_start_vma(tlb, vma);
>> walk_page_range(addr, end, &free_walk);
>> tlb_end_vma(tlb, vma);
>> + vm_write_end(vma);
>> }
>>
>> static int madvise_free_single_vma(struct vm_area_struct *vma,
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index e0e706f0b34e..2632c6f93b63 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -380,8 +380,11 @@ void mpol_rebind_mm(struct mm_struct *mm, nodemask_t *new)
>> struct vm_area_struct *vma;
>>
>> down_write(&mm->mmap_sem);
>> - for (vma = mm->mmap; vma; vma = vma->vm_next)
>> + for (vma = mm->mmap; vma; vma = vma->vm_next) {
>> + vm_write_begin(vma);
>> mpol_rebind_policy(vma->vm_policy, new);
>> + vm_write_end(vma);
>> + }
>> up_write(&mm->mmap_sem);
>> }
>>
>> @@ -554,9 +557,11 @@ unsigned long change_prot_numa(struct vm_area_struct *vma,
>> {
>> int nr_updated;
>>
>> + vm_write_begin(vma);
>> nr_updated = change_protection(vma, addr, end, PAGE_NONE, 0, 1);
>> if (nr_updated)
>> count_vm_numa_events(NUMA_PTE_UPDATES, nr_updated);
>> + vm_write_end(vma);
>>
>> return nr_updated;
>> }
>> @@ -657,6 +662,7 @@ static int vma_replace_policy(struct vm_area_struct *vma,
>> if (IS_ERR(new))
>> return PTR_ERR(new);
>>
>> + vm_write_begin(vma);
>> if (vma->vm_ops && vma->vm_ops->set_policy) {
>> err = vma->vm_ops->set_policy(vma, new);
>> if (err)
>> @@ -664,11 +670,17 @@ static int vma_replace_policy(struct vm_area_struct *vma,
>> }
>>
>> old = vma->vm_policy;
>> - vma->vm_policy = new; /* protected by mmap_sem */
>> + /*
>> + * The speculative page fault handler access this field without
>> + * hodling the mmap_sem.
>> + */
>
> "The speculative page fault handler accesses this field without holding
> vma->vm_mm->mmap_sem"
Oops :/
>
>> + WRITE_ONCE(vma->vm_policy, new);
>> + vm_write_end(vma);
>> mpol_put(old);
>>
>> return 0;
>> err_out:
>> + vm_write_end(vma);
>> mpol_put(new);
>> return err;
>> }
>
> Wait, doesn't vma_dup_policy() also need to protect dst->vm_policy?
Indeed this is not necessary because vma_dup_policy() is called when dst is not
yet linked in the RB tree, so it can't be found by the speculative page fault
handler. This is not the case of vma_replace_policy, and this is why the
protection are needed here.
>
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -2121,7 +2121,9 @@ int vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
>
> if (IS_ERR(pol))
> return PTR_ERR(pol);
> - dst->vm_policy = pol;
> + vm_write_begin(dst);
> + WRITE_ONCE(dst->vm_policy, pol);
> + vm_write_end(dst);
> return 0;
> }
next prev parent reply other threads:[~2018-03-28 16:57 UTC|newest]
Thread overview: 98+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-13 17:59 [PATCH v9 00/24] Speculative page faults Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 01/24] mm: Introduce CONFIG_SPECULATIVE_PAGE_FAULT Laurent Dufour
2018-03-25 21:50 ` David Rientjes
2018-03-28 7:49 ` Laurent Dufour
2018-03-28 10:16 ` David Rientjes
2018-03-28 11:15 ` Laurent Dufour
2018-03-28 21:18 ` David Rientjes
2018-03-13 17:59 ` [PATCH v9 02/24] x86/mm: Define CONFIG_SPECULATIVE_PAGE_FAULT Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 03/24] powerpc/mm: " Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 05/24] mm: Introduce pte_spinlock for FAULT_FLAG_SPECULATIVE Laurent Dufour
2018-03-25 21:50 ` David Rientjes
2018-03-28 8:15 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 06/24] mm: make pte_unmap_same compatible with SPF Laurent Dufour
2018-03-27 21:18 ` David Rientjes
2018-03-28 8:27 ` Laurent Dufour
2018-03-28 10:20 ` David Rientjes
2018-03-28 10:43 ` Laurent Dufour
2018-04-03 19:10 ` Jerome Glisse
2018-04-03 20:40 ` David Rientjes
2018-04-03 21:04 ` Jerome Glisse
2018-04-04 9:53 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 08/24] mm: Protect VMA modifications using VMA sequence count Laurent Dufour
2018-03-27 21:45 ` David Rientjes
2018-03-28 16:57 ` Laurent Dufour [this message]
2018-03-27 21:57 ` David Rientjes
2018-03-28 17:10 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 09/24] mm: protect mremap() against SPF hanlder Laurent Dufour
2018-03-27 22:12 ` David Rientjes
2018-03-28 18:11 ` Laurent Dufour
2018-03-28 21:21 ` David Rientjes
2018-04-04 8:24 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 10/24] mm: Protect SPF handler against anon_vma changes Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 11/24] mm: Cache some VMA fields in the vm_fault structure Laurent Dufour
2018-04-02 22:24 ` David Rientjes
2018-04-04 15:48 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 12/24] mm/migrate: Pass vm_fault pointer to migrate_misplaced_page() Laurent Dufour
2018-04-02 23:00 ` David Rientjes
2018-03-13 17:59 ` [PATCH v9 13/24] mm: Introduce __lru_cache_add_active_or_unevictable Laurent Dufour
2018-04-02 23:11 ` David Rientjes
2018-03-13 17:59 ` [PATCH v9 14/24] mm: Introduce __maybe_mkwrite() Laurent Dufour
2018-04-02 23:12 ` David Rientjes
2018-04-04 15:56 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 15/24] mm: Introduce __vm_normal_page() Laurent Dufour
2018-04-02 23:18 ` David Rientjes
2018-04-04 16:04 ` Laurent Dufour
2018-04-03 19:39 ` Jerome Glisse
2018-04-03 20:45 ` David Rientjes
2018-04-04 16:26 ` Laurent Dufour
2018-04-04 21:59 ` Jerome Glisse
2018-04-05 12:53 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 16/24] mm: Introduce __page_add_new_anon_rmap() Laurent Dufour
2018-04-02 23:57 ` David Rientjes
2018-04-10 16:30 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 17/24] mm: Protect mm_rb tree with a rwlock Laurent Dufour
2018-03-14 8:48 ` Peter Zijlstra
2018-03-14 16:25 ` Laurent Dufour
2018-03-16 10:23 ` [mm] b33ddf50eb: INFO:trying_to_register_non-static_key kernel test robot
2018-03-16 16:38 ` Laurent Dufour
2018-04-03 0:11 ` [PATCH v9 17/24] mm: Protect mm_rb tree with a rwlock David Rientjes
2018-04-06 14:23 ` Laurent Dufour
2018-04-10 16:20 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 18/24] mm: Provide speculative fault infrastructure Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 19/24] mm: Adding speculative page fault failure trace events Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 20/24] perf: Add a speculative page fault sw event Laurent Dufour
2018-03-26 21:43 ` David Rientjes
2018-03-13 17:59 ` [PATCH v9 21/24] perf tools: Add support for the SPF perf event Laurent Dufour
2018-03-26 21:44 ` David Rientjes
2018-03-27 3:49 ` Andi Kleen
2018-04-10 6:47 ` David Rientjes
2018-04-12 13:44 ` Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 22/24] mm: Speculative page fault handler return VMA Laurent Dufour
2018-03-13 17:59 ` [PATCH v9 23/24] x86/mm: Add speculative pagefault handling Laurent Dufour
2018-03-26 21:41 ` David Rientjes
2018-03-13 17:59 ` [PATCH v9 24/24] powerpc/mm: Add speculative page fault Laurent Dufour
2018-03-26 21:39 ` David Rientjes
2018-03-14 13:11 ` [PATCH v9 00/24] Speculative page faults Michal Hocko
2018-03-14 13:33 ` Laurent Dufour
2018-04-13 13:34 ` Laurent Dufour
2018-03-22 1:21 ` Ganesh Mahendran
2018-03-29 12:49 ` Laurent Dufour
[not found] ` <1520963994-28477-5-git-send-email-ldufour@linux.vnet.ibm.com>
2018-03-25 21:50 ` [PATCH v9 04/24] mm: Prepare for FAULT_FLAG_SPECULATIVE David Rientjes
2018-03-28 10:27 ` Laurent Dufour
2018-04-03 21:57 ` David Rientjes
2018-04-04 9:23 ` Laurent Dufour
[not found] ` <1520963994-28477-8-git-send-email-ldufour@linux.vnet.ibm.com>
2018-03-17 7:51 ` [mm] b1f0502d04: INFO:trying_to_register_non-static_key kernel test robot
2018-03-21 12:21 ` Laurent Dufour
2018-03-25 22:10 ` David Rientjes
2018-03-28 13:30 ` Laurent Dufour
2018-04-04 0:48 ` David Rientjes
2018-04-04 1:03 ` David Rientjes
2018-04-04 10:28 ` Laurent Dufour
2018-04-04 10:19 ` Laurent Dufour
2018-04-04 21:53 ` David Rientjes
2018-04-05 16:55 ` Laurent Dufour
2018-03-27 21:30 ` [PATCH v9 07/24] mm: VMA sequence count David Rientjes
2018-03-28 17:58 ` Laurent Dufour
2018-04-03 20:37 ` [PATCH v9 00/24] Speculative page faults Jerome Glisse
2018-04-04 7:59 ` Laurent Dufour
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8bb04603-f55e-3c46-8f29-a183ba6ef47b@linux.vnet.ibm.com \
--to=ldufour@linux.vnet.ibm.com \
--cc=aarcange@redhat.com \
--cc=ak@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=alexei.starovoitov@gmail.com \
--cc=benh@kernel.crashing.org \
--cc=bsingharora@gmail.com \
--cc=daniel.m.jordan@oracle.com \
--cc=dave@stgolabs.net \
--cc=haren@linux.vnet.ibm.com \
--cc=hpa@zytor.com \
--cc=jack@suse.cz \
--cc=kemi.wang@intel.com \
--cc=khandual@linux.vnet.ibm.com \
--cc=kirill@shutemov.name \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mhocko@kernel.org \
--cc=mingo@redhat.com \
--cc=mpe@ellerman.id.au \
--cc=npiggin@gmail.com \
--cc=paulmck@linux.vnet.ibm.com \
--cc=paulus@samba.org \
--cc=peterz@infradead.org \
--cc=rientjes@google.com \
--cc=sergey.senozhatsky.work@gmail.com \
--cc=sergey.senozhatsky@gmail.com \
--cc=tglx@linutronix.de \
--cc=tim.c.chen@linux.intel.com \
--cc=will.deacon@arm.com \
--cc=willy@infradead.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).