Re: [PATCH] mm: write protect MADV_FREE pages

[Shaohua Li <shli@fb.com>]

On Mon, Jan 23, 2017 at 03:28:14PM -0800, Andrew Morton wrote:
> On Mon, 23 Jan 2017 15:15:52 -0800 Shaohua Li <shli@fb.com> wrote:
> 
> > The page reclaim has an assumption writting to a page with clean pte
> > should trigger a page fault, because there is a window between pte zero
> > and tlb flush where a new write could come. If the new write doesn't
> > trigger page fault, page reclaim will not notice it and think the page
> > is clean and reclaim it. The MADV_FREE pages don't comply with the rule
> > and the pte is just cleaned without writeprotect, so there will be no
> > pagefault for new write. This will cause data corruption.
> 
> I'd like to see here a complete description of the bug's effects: waht
> sort of workload will trigger it, what the end-user visible effects
> are, etc.

I don't have a real workload to trigger this, it's from code study, sorry. I
thought a workload like this triggering the bug:

madvise(MADV_FREE) /* memory range */
write to the memory range
read from the memory range

With memory pressure, the data read by the application could be all 0 instead
of those written
 
> > --- a/mm/huge_memory.c
> > +++ b/mm/huge_memory.c
> > @@ -1381,6 +1381,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
> >  			tlb->fullmm);
> >  		orig_pmd = pmd_mkold(orig_pmd);
> >  		orig_pmd = pmd_mkclean(orig_pmd);
> > +		orig_pmd = pmd_wrprotect(orig_pmd);
> 
> Is this the right way round?  There's still a window where we won't get
> that write fault on the cleaned pte.  Should the pmd_wrprotect() happen
> before the pmd_mkclean()?

This doesn't matter. We haven't set the pmd value to page table yet

Thanks,
Shaohua 
> >  		set_pmd_at(mm, addr, pmd, orig_pmd);
> >  		tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
> > diff --git a/mm/madvise.c b/mm/madvise.c
> > index 0e3828e..bfb6800 100644
> > --- a/mm/madvise.c
> > +++ b/mm/madvise.c
> > @@ -373,6 +373,7 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr,
> >  
> >  			ptent = pte_mkold(ptent);
> >  			ptent = pte_mkclean(ptent);
> > +			ptent = pte_wrprotect(ptent);
> >  			set_pte_at(mm, addr, pte, ptent);
> >  			if (PageActive(page))
> >  				deactivate_page(page);
> 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>