* [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
@ 2021-11-24 23:59 Suren Baghdasaryan
2021-11-24 23:59 ` [PATCH v2 2/2] mm/oom_kill: allow process_mrelease to run under mmap_lock protection Suren Baghdasaryan
2021-11-29 11:23 ` [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap Michal Hocko
0 siblings, 2 replies; 9+ messages in thread
From: Suren Baghdasaryan @ 2021-11-24 23:59 UTC (permalink / raw)
To: akpm
Cc: mhocko, mhocko, rientjes, willy, hannes, guro, riel, minchan,
kirill, aarcange, christian, hch, oleg, david, jannh, shakeelb,
luto, christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team, surenb
oom-reaper and process_mrelease system call should protect against
races with exit_mmap which can destroy page tables while they
walk the VMA tree. oom-reaper protects from that race by setting
MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
before taking and releasing mmap_write_lock. process_mrelease has
to elevate mm->mm_users to prevent such race. Both oom-reaper and
process_mrelease hold mmap_read_lock when walking the VMA tree.
The locking rules and mechanisms could be simpler if exit_mmap takes
mmap_write_lock while executing destructive operations such as
free_pgtables.
Change exit_mmap to hold the mmap_write_lock when calling
free_pgtables. Operations like unmap_vmas() and unlock_range() are not
destructive and could run under mmap_read_lock but for simplicity we
take one mmap_write_lock during almost the entire operation. Note
also that because oom-reaper checks VM_LOCKED flag, unlock_range()
should not be allowed to race with it.
In most cases this lock should be uncontended. Previously, Kirill
reported ~4% regression caused by a similar change [1]. We reran the
same test and although the individual results are quite noisy, the
percentiles show lower regression with 1.6% being the worst case [2].
The change allows oom-reaper and process_mrelease to execute safely
under mmap_read_lock without worries that exit_mmap might destroy page
tables from under them.
[1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
[2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
---
changes in v2
- Moved mmap_write_unlock to cover remove_vma loop as well, per Matthew Wilcox
mm/mmap.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/mm/mmap.c b/mm/mmap.c
index bfb0ea164a90..f4e09d390a07 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -3142,25 +3142,27 @@ void exit_mmap(struct mm_struct *mm)
* to mmu_notifier_release(mm) ensures mmu notifier callbacks in
* __oom_reap_task_mm() will not block.
*
- * This needs to be done before calling munlock_vma_pages_all(),
+ * This needs to be done before calling unlock_range(),
* which clears VM_LOCKED, otherwise the oom reaper cannot
* reliably test it.
*/
(void)__oom_reap_task_mm(mm);
set_bit(MMF_OOM_SKIP, &mm->flags);
- mmap_write_lock(mm);
- mmap_write_unlock(mm);
}
+ mmap_write_lock(mm);
if (mm->locked_vm)
unlock_range(mm->mmap, ULONG_MAX);
arch_exit_mmap(mm);
vma = mm->mmap;
- if (!vma) /* Can happen if dup_mmap() received an OOM */
+ if (!vma) {
+ /* Can happen if dup_mmap() received an OOM */
+ mmap_write_unlock(mm);
return;
+ }
lru_add_drain();
flush_cache_mm(mm);
@@ -3171,16 +3173,14 @@ void exit_mmap(struct mm_struct *mm)
free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
tlb_finish_mmu(&tlb);
- /*
- * Walk the list again, actually closing and freeing it,
- * with preemption enabled, without holding any MM locks.
- */
+ /* Walk the list again, actually closing and freeing it. */
while (vma) {
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += vma_pages(vma);
vma = remove_vma(vma);
cond_resched();
}
+ mmap_write_unlock(mm);
vm_unacct_memory(nr_accounted);
}
--
2.34.0.rc2.393.gf8c9666880-goog
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v2 2/2] mm/oom_kill: allow process_mrelease to run under mmap_lock protection
2021-11-24 23:59 [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap Suren Baghdasaryan
@ 2021-11-24 23:59 ` Suren Baghdasaryan
2021-11-29 11:23 ` [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap Michal Hocko
1 sibling, 0 replies; 9+ messages in thread
From: Suren Baghdasaryan @ 2021-11-24 23:59 UTC (permalink / raw)
To: akpm
Cc: mhocko, mhocko, rientjes, willy, hannes, guro, riel, minchan,
kirill, aarcange, christian, hch, oleg, david, jannh, shakeelb,
luto, christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team, surenb
With exit_mmap holding mmap_write_lock during free_pgtables call,
process_mrelease does not need to elevate mm->mm_users in order to
prevent exit_mmap from destrying pagetables while __oom_reap_task_mm
is walking the VMA tree. The change prevents process_mrelease from
calling the last mmput, which can lead to waiting for IO completion
in exit_aio.
Fixes: 337546e83fc7 ("mm/oom_kill.c: prevent a race between process_mrelease and exit_mmap")
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
---
mm/oom_kill.c | 27 +++++++++++++++------------
1 file changed, 15 insertions(+), 12 deletions(-)
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 1ddabefcfb5a..67780386f478 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -1169,15 +1169,15 @@ SYSCALL_DEFINE2(process_mrelease, int, pidfd, unsigned int, flags)
goto put_task;
}
- if (mmget_not_zero(p->mm)) {
- mm = p->mm;
- if (task_will_free_mem(p))
- reap = true;
- else {
- /* Error only if the work has not been done already */
- if (!test_bit(MMF_OOM_SKIP, &mm->flags))
- ret = -EINVAL;
- }
+ mm = p->mm;
+ mmgrab(mm);
+
+ if (task_will_free_mem(p))
+ reap = true;
+ else {
+ /* Error only if the work has not been done already */
+ if (!test_bit(MMF_OOM_SKIP, &mm->flags))
+ ret = -EINVAL;
}
task_unlock(p);
@@ -1188,13 +1188,16 @@ SYSCALL_DEFINE2(process_mrelease, int, pidfd, unsigned int, flags)
ret = -EINTR;
goto drop_mm;
}
- if (!__oom_reap_task_mm(mm))
+ /*
+ * Check MMF_OOM_SKIP again under mmap_read_lock protection to ensure
+ * possible change in exit_mmap is seen
+ */
+ if (!test_bit(MMF_OOM_SKIP, &mm->flags) && !__oom_reap_task_mm(mm))
ret = -EAGAIN;
mmap_read_unlock(mm);
drop_mm:
- if (mm)
- mmput(mm);
+ mmdrop(mm);
put_task:
put_task_struct(task);
return ret;
--
2.34.0.rc2.393.gf8c9666880-goog
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
2021-11-24 23:59 [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap Suren Baghdasaryan
2021-11-24 23:59 ` [PATCH v2 2/2] mm/oom_kill: allow process_mrelease to run under mmap_lock protection Suren Baghdasaryan
@ 2021-11-29 11:23 ` Michal Hocko
2021-12-06 18:35 ` Suren Baghdasaryan
1 sibling, 1 reply; 9+ messages in thread
From: Michal Hocko @ 2021-11-29 11:23 UTC (permalink / raw)
To: Suren Baghdasaryan
Cc: akpm, rientjes, willy, hannes, guro, riel, minchan, kirill,
aarcange, christian, hch, oleg, david, jannh, shakeelb, luto,
christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team
On Wed 24-11-21 15:59:05, Suren Baghdasaryan wrote:
> oom-reaper and process_mrelease system call should protect against
> races with exit_mmap which can destroy page tables while they
> walk the VMA tree. oom-reaper protects from that race by setting
> MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
> before taking and releasing mmap_write_lock. process_mrelease has
> to elevate mm->mm_users to prevent such race. Both oom-reaper and
> process_mrelease hold mmap_read_lock when walking the VMA tree.
> The locking rules and mechanisms could be simpler if exit_mmap takes
> mmap_write_lock while executing destructive operations such as
> free_pgtables.
> Change exit_mmap to hold the mmap_write_lock when calling
> free_pgtables. Operations like unmap_vmas() and unlock_range() are not
> destructive and could run under mmap_read_lock but for simplicity we
> take one mmap_write_lock during almost the entire operation. Note
> also that because oom-reaper checks VM_LOCKED flag, unlock_range()
> should not be allowed to race with it.
> In most cases this lock should be uncontended. Previously, Kirill
> reported ~4% regression caused by a similar change [1]. We reran the
> same test and although the individual results are quite noisy, the
> percentiles show lower regression with 1.6% being the worst case [2].
> The change allows oom-reaper and process_mrelease to execute safely
> under mmap_read_lock without worries that exit_mmap might destroy page
> tables from under them.
>
> [1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
> [2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/
>
> Signed-off-by: Suren Baghdasaryan <surenb@google.com>
> ---
> changes in v2
> - Moved mmap_write_unlock to cover remove_vma loop as well, per Matthew Wilcox
>
> mm/mmap.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/mm/mmap.c b/mm/mmap.c
> index bfb0ea164a90..f4e09d390a07 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -3142,25 +3142,27 @@ void exit_mmap(struct mm_struct *mm)
> * to mmu_notifier_release(mm) ensures mmu notifier callbacks in
> * __oom_reap_task_mm() will not block.
> *
> - * This needs to be done before calling munlock_vma_pages_all(),
> + * This needs to be done before calling unlock_range(),
> * which clears VM_LOCKED, otherwise the oom reaper cannot
> * reliably test it.
> */
> (void)__oom_reap_task_mm(mm);
>
> set_bit(MMF_OOM_SKIP, &mm->flags);
Why do you keep this in place?
Other than that looks OK to me. Maybe we want to add an explicit note
that vm_ops::close cannot take mmap_sem in any form. The changelog
should also mention that you have considered remove_vma and its previous
no MM locking assumption. You can argue that fput is async and close
callback shouldn't really need mmap_sem.
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
2021-11-29 11:23 ` [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap Michal Hocko
@ 2021-12-06 18:35 ` Suren Baghdasaryan
2021-12-06 18:52 ` Matthew Wilcox
2021-12-07 10:09 ` Michal Hocko
0 siblings, 2 replies; 9+ messages in thread
From: Suren Baghdasaryan @ 2021-12-06 18:35 UTC (permalink / raw)
To: Michal Hocko
Cc: akpm, rientjes, willy, hannes, guro, riel, minchan, kirill,
aarcange, christian, hch, oleg, david, jannh, shakeelb, luto,
christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team
On Mon, Nov 29, 2021 at 3:23 AM Michal Hocko <mhocko@suse.com> wrote:
>
> On Wed 24-11-21 15:59:05, Suren Baghdasaryan wrote:
> > oom-reaper and process_mrelease system call should protect against
> > races with exit_mmap which can destroy page tables while they
> > walk the VMA tree. oom-reaper protects from that race by setting
> > MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
> > before taking and releasing mmap_write_lock. process_mrelease has
> > to elevate mm->mm_users to prevent such race. Both oom-reaper and
> > process_mrelease hold mmap_read_lock when walking the VMA tree.
> > The locking rules and mechanisms could be simpler if exit_mmap takes
> > mmap_write_lock while executing destructive operations such as
> > free_pgtables.
> > Change exit_mmap to hold the mmap_write_lock when calling
> > free_pgtables. Operations like unmap_vmas() and unlock_range() are not
> > destructive and could run under mmap_read_lock but for simplicity we
> > take one mmap_write_lock during almost the entire operation. Note
> > also that because oom-reaper checks VM_LOCKED flag, unlock_range()
> > should not be allowed to race with it.
> > In most cases this lock should be uncontended. Previously, Kirill
> > reported ~4% regression caused by a similar change [1]. We reran the
> > same test and although the individual results are quite noisy, the
> > percentiles show lower regression with 1.6% being the worst case [2].
> > The change allows oom-reaper and process_mrelease to execute safely
> > under mmap_read_lock without worries that exit_mmap might destroy page
> > tables from under them.
> >
> > [1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
> > [2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/
> >
> > Signed-off-by: Suren Baghdasaryan <surenb@google.com>
> > ---
> > changes in v2
> > - Moved mmap_write_unlock to cover remove_vma loop as well, per Matthew Wilcox
> >
> > mm/mmap.c | 16 ++++++++--------
> > 1 file changed, 8 insertions(+), 8 deletions(-)
> >
> > diff --git a/mm/mmap.c b/mm/mmap.c
> > index bfb0ea164a90..f4e09d390a07 100644
> > --- a/mm/mmap.c
> > +++ b/mm/mmap.c
> > @@ -3142,25 +3142,27 @@ void exit_mmap(struct mm_struct *mm)
> > * to mmu_notifier_release(mm) ensures mmu notifier callbacks in
> > * __oom_reap_task_mm() will not block.
> > *
> > - * This needs to be done before calling munlock_vma_pages_all(),
> > + * This needs to be done before calling unlock_range(),
> > * which clears VM_LOCKED, otherwise the oom reaper cannot
> > * reliably test it.
> > */
> > (void)__oom_reap_task_mm(mm);
> >
> > set_bit(MMF_OOM_SKIP, &mm->flags);
>
> Why do you keep this in place?
Sorry for the delay, I was out last week.
I missed your comment about removing MMF_OOM_SKIP at
https://lore.kernel.org/all/YYrO%2FPwdsyaxJaNZ@dhcp22.suse.cz
I'll look into removing it in a separate patch, which I think would be cleaner.
>
> Other than that looks OK to me. Maybe we want to add an explicit note
> that vm_ops::close cannot take mmap_sem in any form. The changelog
> should also mention that you have considered remove_vma and its previous
> no MM locking assumption. You can argue that fput is async and close
> callback shouldn't really need mmap_sem.
Should I post another version of this patch with the patch description
clarifying these points and additional comments as you suggested?
> --
> Michal Hocko
> SUSE Labs
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
2021-12-06 18:35 ` Suren Baghdasaryan
@ 2021-12-06 18:52 ` Matthew Wilcox
2021-12-07 10:03 ` Michal Hocko
2021-12-07 10:09 ` Michal Hocko
1 sibling, 1 reply; 9+ messages in thread
From: Matthew Wilcox @ 2021-12-06 18:52 UTC (permalink / raw)
To: Suren Baghdasaryan
Cc: Michal Hocko, akpm, rientjes, hannes, guro, riel, minchan,
kirill, aarcange, christian, hch, oleg, david, jannh, shakeelb,
luto, christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team
On Mon, Dec 06, 2021 at 10:35:03AM -0800, Suren Baghdasaryan wrote:
> > Other than that looks OK to me. Maybe we want to add an explicit note
> > that vm_ops::close cannot take mmap_sem in any form. The changelog
> > should also mention that you have considered remove_vma and its previous
> > no MM locking assumption. You can argue that fput is async and close
> > callback shouldn't really need mmap_sem.
>
> Should I post another version of this patch with the patch description
> clarifying these points and additional comments as you suggested?
fyi, vm_ops->close() is already called with the mmap_sem held for write
in __split_vma(). If that needs to be documented, it's a separate patch
because it's absolutely not a consequence of this patch.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
2021-12-06 18:52 ` Matthew Wilcox
@ 2021-12-07 10:03 ` Michal Hocko
0 siblings, 0 replies; 9+ messages in thread
From: Michal Hocko @ 2021-12-07 10:03 UTC (permalink / raw)
To: Matthew Wilcox
Cc: Suren Baghdasaryan, akpm, rientjes, hannes, guro, riel, minchan,
kirill, aarcange, christian, hch, oleg, david, jannh, shakeelb,
luto, christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team
On Mon 06-12-21 18:52:28, Matthew Wilcox wrote:
> On Mon, Dec 06, 2021 at 10:35:03AM -0800, Suren Baghdasaryan wrote:
> > > Other than that looks OK to me. Maybe we want to add an explicit note
> > > that vm_ops::close cannot take mmap_sem in any form. The changelog
> > > should also mention that you have considered remove_vma and its previous
> > > no MM locking assumption. You can argue that fput is async and close
> > > callback shouldn't really need mmap_sem.
> >
> > Should I post another version of this patch with the patch description
> > clarifying these points and additional comments as you suggested?
>
> fyi, vm_ops->close() is already called with the mmap_sem held for write
> in __split_vma(). If that needs to be documented, it's a separate patch
> because it's absolutely not a consequence of this patch.
Agreed! We definitely want to document that.
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
2021-12-06 18:35 ` Suren Baghdasaryan
2021-12-06 18:52 ` Matthew Wilcox
@ 2021-12-07 10:09 ` Michal Hocko
2021-12-07 16:50 ` Suren Baghdasaryan
1 sibling, 1 reply; 9+ messages in thread
From: Michal Hocko @ 2021-12-07 10:09 UTC (permalink / raw)
To: Suren Baghdasaryan
Cc: akpm, rientjes, willy, hannes, guro, riel, minchan, kirill,
aarcange, christian, hch, oleg, david, jannh, shakeelb, luto,
christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team
On Mon 06-12-21 10:35:03, Suren Baghdasaryan wrote:
> On Mon, Nov 29, 2021 at 3:23 AM Michal Hocko <mhocko@suse.com> wrote:
> >
> > On Wed 24-11-21 15:59:05, Suren Baghdasaryan wrote:
> > > oom-reaper and process_mrelease system call should protect against
> > > races with exit_mmap which can destroy page tables while they
> > > walk the VMA tree. oom-reaper protects from that race by setting
> > > MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
> > > before taking and releasing mmap_write_lock. process_mrelease has
> > > to elevate mm->mm_users to prevent such race. Both oom-reaper and
> > > process_mrelease hold mmap_read_lock when walking the VMA tree.
> > > The locking rules and mechanisms could be simpler if exit_mmap takes
> > > mmap_write_lock while executing destructive operations such as
> > > free_pgtables.
> > > Change exit_mmap to hold the mmap_write_lock when calling
> > > free_pgtables. Operations like unmap_vmas() and unlock_range() are not
> > > destructive and could run under mmap_read_lock but for simplicity we
> > > take one mmap_write_lock during almost the entire operation. Note
> > > also that because oom-reaper checks VM_LOCKED flag, unlock_range()
> > > should not be allowed to race with it.
> > > In most cases this lock should be uncontended. Previously, Kirill
> > > reported ~4% regression caused by a similar change [1]. We reran the
> > > same test and although the individual results are quite noisy, the
> > > percentiles show lower regression with 1.6% being the worst case [2].
> > > The change allows oom-reaper and process_mrelease to execute safely
> > > under mmap_read_lock without worries that exit_mmap might destroy page
> > > tables from under them.
> > >
> > > [1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
> > > [2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/
> > >
> > > Signed-off-by: Suren Baghdasaryan <surenb@google.com>
> > > ---
> > > changes in v2
> > > - Moved mmap_write_unlock to cover remove_vma loop as well, per Matthew Wilcox
> > >
> > > mm/mmap.c | 16 ++++++++--------
> > > 1 file changed, 8 insertions(+), 8 deletions(-)
> > >
> > > diff --git a/mm/mmap.c b/mm/mmap.c
> > > index bfb0ea164a90..f4e09d390a07 100644
> > > --- a/mm/mmap.c
> > > +++ b/mm/mmap.c
> > > @@ -3142,25 +3142,27 @@ void exit_mmap(struct mm_struct *mm)
> > > * to mmu_notifier_release(mm) ensures mmu notifier callbacks in
> > > * __oom_reap_task_mm() will not block.
> > > *
> > > - * This needs to be done before calling munlock_vma_pages_all(),
> > > + * This needs to be done before calling unlock_range(),
> > > * which clears VM_LOCKED, otherwise the oom reaper cannot
> > > * reliably test it.
> > > */
> > > (void)__oom_reap_task_mm(mm);
> > >
> > > set_bit(MMF_OOM_SKIP, &mm->flags);
> >
> > Why do you keep this in place?
>
> Sorry for the delay, I was out last week.
> I missed your comment about removing MMF_OOM_SKIP at
> https://lore.kernel.org/all/YYrO%2FPwdsyaxJaNZ@dhcp22.suse.cz
> I'll look into removing it in a separate patch, which I think would be cleaner.
The point of this code was to sync up the oom_repaer and exit_mmap. Now
that your patch uses proper locking for that to happen then MMF_OOM_SKIP
is not really necessary. IIRC all you need to guarantee is that the vma
tree is empty when exit_mmap does all its work - i.e set mm->mmap to
NULL. You can do that after remove_vma loop but it would be equally safe
at any time after vma = mm->mmap as the loop relies on the vma chain.
Doing that after would be slightly nicer if you ask me.
> > Other than that looks OK to me. Maybe we want to add an explicit note
> > that vm_ops::close cannot take mmap_sem in any form. The changelog
> > should also mention that you have considered remove_vma and its previous
> > no MM locking assumption. You can argue that fput is async and close
> > callback shouldn't really need mmap_sem.
>
> Should I post another version of this patch with the patch description
> clarifying these points and additional comments as you suggested?
Yes please.
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
2021-12-07 10:09 ` Michal Hocko
@ 2021-12-07 16:50 ` Suren Baghdasaryan
2021-12-07 21:54 ` Suren Baghdasaryan
0 siblings, 1 reply; 9+ messages in thread
From: Suren Baghdasaryan @ 2021-12-07 16:50 UTC (permalink / raw)
To: Michal Hocko
Cc: akpm, rientjes, willy, hannes, guro, riel, minchan, kirill,
aarcange, christian, hch, oleg, david, jannh, shakeelb, luto,
christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team
On Tue, Dec 7, 2021 at 2:10 AM Michal Hocko <mhocko@suse.com> wrote:
>
> On Mon 06-12-21 10:35:03, Suren Baghdasaryan wrote:
> > On Mon, Nov 29, 2021 at 3:23 AM Michal Hocko <mhocko@suse.com> wrote:
> > >
> > > On Wed 24-11-21 15:59:05, Suren Baghdasaryan wrote:
> > > > oom-reaper and process_mrelease system call should protect against
> > > > races with exit_mmap which can destroy page tables while they
> > > > walk the VMA tree. oom-reaper protects from that race by setting
> > > > MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
> > > > before taking and releasing mmap_write_lock. process_mrelease has
> > > > to elevate mm->mm_users to prevent such race. Both oom-reaper and
> > > > process_mrelease hold mmap_read_lock when walking the VMA tree.
> > > > The locking rules and mechanisms could be simpler if exit_mmap takes
> > > > mmap_write_lock while executing destructive operations such as
> > > > free_pgtables.
> > > > Change exit_mmap to hold the mmap_write_lock when calling
> > > > free_pgtables. Operations like unmap_vmas() and unlock_range() are not
> > > > destructive and could run under mmap_read_lock but for simplicity we
> > > > take one mmap_write_lock during almost the entire operation. Note
> > > > also that because oom-reaper checks VM_LOCKED flag, unlock_range()
> > > > should not be allowed to race with it.
> > > > In most cases this lock should be uncontended. Previously, Kirill
> > > > reported ~4% regression caused by a similar change [1]. We reran the
> > > > same test and although the individual results are quite noisy, the
> > > > percentiles show lower regression with 1.6% being the worst case [2].
> > > > The change allows oom-reaper and process_mrelease to execute safely
> > > > under mmap_read_lock without worries that exit_mmap might destroy page
> > > > tables from under them.
> > > >
> > > > [1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
> > > > [2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/
> > > >
> > > > Signed-off-by: Suren Baghdasaryan <surenb@google.com>
> > > > ---
> > > > changes in v2
> > > > - Moved mmap_write_unlock to cover remove_vma loop as well, per Matthew Wilcox
> > > >
> > > > mm/mmap.c | 16 ++++++++--------
> > > > 1 file changed, 8 insertions(+), 8 deletions(-)
> > > >
> > > > diff --git a/mm/mmap.c b/mm/mmap.c
> > > > index bfb0ea164a90..f4e09d390a07 100644
> > > > --- a/mm/mmap.c
> > > > +++ b/mm/mmap.c
> > > > @@ -3142,25 +3142,27 @@ void exit_mmap(struct mm_struct *mm)
> > > > * to mmu_notifier_release(mm) ensures mmu notifier callbacks in
> > > > * __oom_reap_task_mm() will not block.
> > > > *
> > > > - * This needs to be done before calling munlock_vma_pages_all(),
> > > > + * This needs to be done before calling unlock_range(),
> > > > * which clears VM_LOCKED, otherwise the oom reaper cannot
> > > > * reliably test it.
> > > > */
> > > > (void)__oom_reap_task_mm(mm);
> > > >
> > > > set_bit(MMF_OOM_SKIP, &mm->flags);
> > >
> > > Why do you keep this in place?
> >
> > Sorry for the delay, I was out last week.
> > I missed your comment about removing MMF_OOM_SKIP at
> > https://lore.kernel.org/all/YYrO%2FPwdsyaxJaNZ@dhcp22.suse.cz
> > I'll look into removing it in a separate patch, which I think would be cleaner.
>
> The point of this code was to sync up the oom_repaer and exit_mmap. Now
> that your patch uses proper locking for that to happen then MMF_OOM_SKIP
> is not really necessary. IIRC all you need to guarantee is that the vma
> tree is empty when exit_mmap does all its work - i.e set mm->mmap to
> NULL. You can do that after remove_vma loop but it would be equally safe
> at any time after vma = mm->mmap as the loop relies on the vma chain.
> Doing that after would be slightly nicer if you ask me.
Will do. But if you don't mind I'll post the removal of MMF_OOM_SKIP
as a separate patch. This patchset has already been extensively tested
and it will be easier for me to test MMF_OOM_SKIP removal separately.
>
> > > Other than that looks OK to me. Maybe we want to add an explicit note
> > > that vm_ops::close cannot take mmap_sem in any form. The changelog
> > > should also mention that you have considered remove_vma and its previous
> > > no MM locking assumption. You can argue that fput is async and close
> > > callback shouldn't really need mmap_sem.
> >
> > Should I post another version of this patch with the patch description
> > clarifying these points and additional comments as you suggested?
>
> Yes please.
Will re-post. So, to clarify, we want:
- Patch description to include explanation that remove_vma is now
being called under MM lock but this should not be a problem because
fput and vm_ops->close do not and should not take mmap_sem.
- Add a comment for vm_ops->close that the callback should not take
mmap_sem, with explanation that __split_vma and exit_mmap use this
callback with the mmap_sem write lock taken.
Is that correct?
>
> --
> Michal Hocko
> SUSE Labs
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap
2021-12-07 16:50 ` Suren Baghdasaryan
@ 2021-12-07 21:54 ` Suren Baghdasaryan
0 siblings, 0 replies; 9+ messages in thread
From: Suren Baghdasaryan @ 2021-12-07 21:54 UTC (permalink / raw)
To: Michal Hocko
Cc: akpm, rientjes, willy, hannes, guro, riel, minchan, kirill,
aarcange, christian, hch, oleg, david, jannh, shakeelb, luto,
christian.brauner, fweimer, jengelh, timmurray, linux-mm,
linux-kernel, kernel-team
On Tue, Dec 7, 2021 at 8:50 AM Suren Baghdasaryan <surenb@google.com> wrote:
>
> On Tue, Dec 7, 2021 at 2:10 AM Michal Hocko <mhocko@suse.com> wrote:
> >
> > On Mon 06-12-21 10:35:03, Suren Baghdasaryan wrote:
> > > On Mon, Nov 29, 2021 at 3:23 AM Michal Hocko <mhocko@suse.com> wrote:
> > > >
> > > > On Wed 24-11-21 15:59:05, Suren Baghdasaryan wrote:
> > > > > oom-reaper and process_mrelease system call should protect against
> > > > > races with exit_mmap which can destroy page tables while they
> > > > > walk the VMA tree. oom-reaper protects from that race by setting
> > > > > MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
> > > > > before taking and releasing mmap_write_lock. process_mrelease has
> > > > > to elevate mm->mm_users to prevent such race. Both oom-reaper and
> > > > > process_mrelease hold mmap_read_lock when walking the VMA tree.
> > > > > The locking rules and mechanisms could be simpler if exit_mmap takes
> > > > > mmap_write_lock while executing destructive operations such as
> > > > > free_pgtables.
> > > > > Change exit_mmap to hold the mmap_write_lock when calling
> > > > > free_pgtables. Operations like unmap_vmas() and unlock_range() are not
> > > > > destructive and could run under mmap_read_lock but for simplicity we
> > > > > take one mmap_write_lock during almost the entire operation. Note
> > > > > also that because oom-reaper checks VM_LOCKED flag, unlock_range()
> > > > > should not be allowed to race with it.
> > > > > In most cases this lock should be uncontended. Previously, Kirill
> > > > > reported ~4% regression caused by a similar change [1]. We reran the
> > > > > same test and although the individual results are quite noisy, the
> > > > > percentiles show lower regression with 1.6% being the worst case [2].
> > > > > The change allows oom-reaper and process_mrelease to execute safely
> > > > > under mmap_read_lock without worries that exit_mmap might destroy page
> > > > > tables from under them.
> > > > >
> > > > > [1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
> > > > > [2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/
> > > > >
> > > > > Signed-off-by: Suren Baghdasaryan <surenb@google.com>
> > > > > ---
> > > > > changes in v2
> > > > > - Moved mmap_write_unlock to cover remove_vma loop as well, per Matthew Wilcox
> > > > >
> > > > > mm/mmap.c | 16 ++++++++--------
> > > > > 1 file changed, 8 insertions(+), 8 deletions(-)
> > > > >
> > > > > diff --git a/mm/mmap.c b/mm/mmap.c
> > > > > index bfb0ea164a90..f4e09d390a07 100644
> > > > > --- a/mm/mmap.c
> > > > > +++ b/mm/mmap.c
> > > > > @@ -3142,25 +3142,27 @@ void exit_mmap(struct mm_struct *mm)
> > > > > * to mmu_notifier_release(mm) ensures mmu notifier callbacks in
> > > > > * __oom_reap_task_mm() will not block.
> > > > > *
> > > > > - * This needs to be done before calling munlock_vma_pages_all(),
> > > > > + * This needs to be done before calling unlock_range(),
> > > > > * which clears VM_LOCKED, otherwise the oom reaper cannot
> > > > > * reliably test it.
> > > > > */
> > > > > (void)__oom_reap_task_mm(mm);
> > > > >
> > > > > set_bit(MMF_OOM_SKIP, &mm->flags);
> > > >
> > > > Why do you keep this in place?
> > >
> > > Sorry for the delay, I was out last week.
> > > I missed your comment about removing MMF_OOM_SKIP at
> > > https://lore.kernel.org/all/YYrO%2FPwdsyaxJaNZ@dhcp22.suse.cz
> > > I'll look into removing it in a separate patch, which I think would be cleaner.
> >
> > The point of this code was to sync up the oom_repaer and exit_mmap. Now
> > that your patch uses proper locking for that to happen then MMF_OOM_SKIP
> > is not really necessary. IIRC all you need to guarantee is that the vma
> > tree is empty when exit_mmap does all its work - i.e set mm->mmap to
> > NULL. You can do that after remove_vma loop but it would be equally safe
> > at any time after vma = mm->mmap as the loop relies on the vma chain.
> > Doing that after would be slightly nicer if you ask me.
>
> Will do. But if you don't mind I'll post the removal of MMF_OOM_SKIP
> as a separate patch. This patchset has already been extensively tested
> and it will be easier for me to test MMF_OOM_SKIP removal separately.
>
> >
> > > > Other than that looks OK to me. Maybe we want to add an explicit note
> > > > that vm_ops::close cannot take mmap_sem in any form. The changelog
> > > > should also mention that you have considered remove_vma and its previous
> > > > no MM locking assumption. You can argue that fput is async and close
> > > > callback shouldn't really need mmap_sem.
> > >
> > > Should I post another version of this patch with the patch description
> > > clarifying these points and additional comments as you suggested?
> >
> > Yes please.
>
> Will re-post. So, to clarify, we want:
> - Patch description to include explanation that remove_vma is now
> being called under MM lock but this should not be a problem because
> fput and vm_ops->close do not and should not take mmap_sem.
> - Add a comment for vm_ops->close that the callback should not take
> mmap_sem, with explanation that __split_vma and exit_mmap use this
> callback with the mmap_sem write lock taken.
> Is that correct?
Assuming my understanding was correct, posted v3 at
https://lore.kernel.org/all/20211207215031.2251719-1-surenb@google.com/
>
> >
> > --
> > Michal Hocko
> > SUSE Labs
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2021-12-07 21:54 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-24 23:59 [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap Suren Baghdasaryan
2021-11-24 23:59 ` [PATCH v2 2/2] mm/oom_kill: allow process_mrelease to run under mmap_lock protection Suren Baghdasaryan
2021-11-29 11:23 ` [PATCH v2 1/2] mm: protect free_pgtables with mmap_lock write lock in exit_mmap Michal Hocko
2021-12-06 18:35 ` Suren Baghdasaryan
2021-12-06 18:52 ` Matthew Wilcox
2021-12-07 10:03 ` Michal Hocko
2021-12-07 10:09 ` Michal Hocko
2021-12-07 16:50 ` Suren Baghdasaryan
2021-12-07 21:54 ` Suren Baghdasaryan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).