Stable Archive on
 help / color / Atom feed
* [merged] mm-do-not-allow-madv_pageout-for-cow-pages.patch removed from -mm tree
@ 2020-03-26 18:16 akpm
  0 siblings, 0 replies; only message in thread
From: akpm @ 2020-03-26 18:16 UTC (permalink / raw)
  To: dancol, dave.hansen, jannh, joel, mhocko, minchan, mm-commits,
	stable, vbabka

The patch titled
     Subject: mm: do not allow MADV_PAGEOUT for CoW pages
has been removed from the -mm tree.  Its filename was

This patch was dropped because it was merged into mainline or a subsystem tree

From: Michal Hocko <>
Subject: mm: do not allow MADV_PAGEOUT for CoW pages

Jann has brought up a very interesting point [1].  While shared pages are
excluded from MADV_PAGEOUT normally, CoW pages can be easily reclaimed
that way.  This can lead to all sorts of hard to debug problems.  E.g. 
performance problems outlined by Daniel [2].

There are runtime environments where there is a substantial memory shared
among security domains via CoW memory and a easy to reclaim way of that
memory, which MADV_{COLD,PAGEOUT} offers, can lead to either performance
degradation in for the parent process which might be more privileged or
even open side channel attacks.

The feasibility of the latter is not really clear to me TBH but there is
no real reason for exposure at this stage.  It seems there is no real use
case to depend on reclaiming CoW memory via madvise at this stage so it is
much easier to simply disallow it and this is what this patch does.  Put
it simply MADV_{PAGEOUT,COLD} can operate only on the exclusively owned
memory which is a straightforward semantic.


Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD")
Signed-off-by: Michal Hocko <>
Reported-by: Jann Horn <>
Acked-by: Vlastimil Babka <>
Cc: Minchan Kim <>
Cc: Daniel Colascione <>
Cc: Dave Hansen <>
Cc: "Joel Fernandes (Google)" <>
Cc: <>
Signed-off-by: Andrew Morton <>

 mm/madvise.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/mm/madvise.c~mm-do-not-allow-madv_pageout-for-cow-pages
+++ a/mm/madvise.c
@@ -335,12 +335,14 @@ static int madvise_cold_or_pageout_pte_r
 		page = pmd_page(orig_pmd);
+		/* Do not interfere with other mappings of this page */
+		if (page_mapcount(page) != 1)
+			goto huge_unlock;
 		if (next - addr != HPAGE_PMD_SIZE) {
 			int err;
-			if (page_mapcount(page) != 1)
-				goto huge_unlock;
@@ -426,6 +428,10 @@ regular_page:
+		/* Do not interfere with other mappings of this page */
+		if (page_mapcount(page) != 1)
+			continue;
 		VM_BUG_ON_PAGE(PageTransCompound(page), page);
 		if (pte_young(ptent)) {

Patches currently in -mm which might be from are


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-26 18:16 [merged] mm-do-not-allow-madv_pageout-for-cow-pages.patch removed from -mm tree akpm

Stable Archive on

Archives are clonable:
	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone