From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2B12C3F2D1 for ; Mon, 2 Mar 2020 13:08:33 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 871F021739 for ; Mon, 2 Mar 2020 13:08:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="HpScS+tM" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 871F021739 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 062896B0005; Mon, 2 Mar 2020 08:08:33 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id F2F7D6B0006; Mon, 2 Mar 2020 08:08:32 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DCFFA6B0007; Mon, 2 Mar 2020 08:08:32 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0116.hostedemail.com [216.40.44.116]) by kanga.kvack.org (Postfix) with ESMTP id C4ACD6B0005 for ; Mon, 2 Mar 2020 08:08:32 -0500 (EST) Received: from smtpin11.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 86795181AC9C6 for ; Mon, 2 Mar 2020 13:08:32 +0000 (UTC) X-FDA: 76550451264.11.look48_4a80fe9d5412a X-HE-Tag: look48_4a80fe9d5412a X-Filterd-Recvd-Size: 7681 Received: from mail-qk1-f193.google.com (mail-qk1-f193.google.com [209.85.222.193]) by imf29.hostedemail.com (Postfix) with ESMTP for ; Mon, 2 Mar 2020 13:08:31 +0000 (UTC) Received: by mail-qk1-f193.google.com with SMTP id m9so9870793qke.4 for ; Mon, 02 Mar 2020 05:08:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=Exs3w+rTuzfG/N+nzVBlnN15vTvcBn9ovGBjfNtUlfg=; b=HpScS+tMr3PBXcYDh7E3drwKUefm/BVbmBBgSanHvjgPH7vujAcVMiMg4Wh4Q5wmnI g5cQHPSutObpSuyPAyajNaslzAGsIAS3j9GLvDktX/Lbhf+Ln0odxSdGZNCQt4fkduRW XZz96cFQpmlTAPTPZo+KEIIvXKb+NgErD42KdCsEzi6WtUUqIwflsPIBrvfkbG+ZwVBX 9ftovfMHuyXsZUrup3P/qwFjwcWfF5cDyVilClYXlzIYZAbXGi95WGt8DiosNJ/onrzt 6YyJXo0UMC9vV8qL6IjK3psqSgvNFAiaOb7g8hxw19tpWAnF5og3YMEhgxX4IqmsZCEw YgqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=Exs3w+rTuzfG/N+nzVBlnN15vTvcBn9ovGBjfNtUlfg=; b=ERHu/tv1LX68g2VGhSTmWfKqMt0SBVCHh+2oYQQWLebCP/BkA819cjXuf1jFA2g1ll tm3AGp/hVvcKG7bPZ+UmI171I5Dl2OtaNxVY6XWGklJVSwa0LknPA+cAPiVchJOz3Tcp xQCtIqyhYz4L5ntUhMMPgP46j1FYMBE6/E/V8t/1BrRooo4fdclv3XCEchTrXEG673DS iaGM7qkESAEnGwA7HFX70f16IiYtxejk4ECn4XtSSGPxpNRE+qOiN3PEK3MWUWSRqb74 tecX7r5qiX2oTLw+OYIAAf61DyOFMNvV7xGg+cvctBLAw2zQik9xKhtSSm3Pih7pINwp 6VMQ== X-Gm-Message-State: ANhLgQ0vcpkEB5p270bvBExzieOVshCIElSr+H+pUIuCBYF88za/WeYP CxoMZnRV8Y5SSnJTfdFxw9V3sQ== X-Google-Smtp-Source: ADFU+vvjNi2YSd4yT408IejJeAF2wjqWVcyc6tZ2B+sE3v7k9AqEZ+wK27ltoUOli5hvEcPv0djrWA== X-Received: by 2002:a05:620a:22c3:: with SMTP id o3mr1775670qki.315.1583154511171; Mon, 02 Mar 2020 05:08:31 -0800 (PST) Received: from ziepe.ca (hlfxns017vw-142-68-57-212.dhcp-dynamic.fibreop.ns.bellaliant.net. [142.68.57.212]) by smtp.gmail.com with ESMTPSA id j18sm9786093qka.95.2020.03.02.05.08.30 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 02 Mar 2020 05:08:30 -0800 (PST) Received: from jgg by mlx.ziepe.ca with local (Exim 4.90_1) (envelope-from ) id 1j8ko9-00049D-Pf; Mon, 02 Mar 2020 09:08:29 -0400 Date: Mon, 2 Mar 2020 09:08:29 -0400 From: Jason Gunthorpe To: Pingfan Liu Cc: Linux-MM , Ira Weiny , Andrew Morton , Mike Rapoport , Dan Williams , Matthew Wilcox , John Hubbard , "Aneesh Kumar K.V" , Keith Busch , Christoph Hellwig , Shuah Khan , LKML Subject: Re: [PATCHv5 2/3] mm/gup: fix omission of check on FOLL_LONGTERM in gup fast path Message-ID: <20200302130829.GW31668@ziepe.ca> References: <1582889550-9101-1-git-send-email-kernelfans@gmail.com> <1582889550-9101-3-git-send-email-kernelfans@gmail.com> <20200228134436.GP31668@ziepe.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.4 (2018-02-28) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Mar 02, 2020 at 10:25:52AM +0800, Pingfan Liu wrote: > On Fri, Feb 28, 2020 at 9:44 PM Jason Gunthorpe wrote: > > > > On Fri, Feb 28, 2020 at 07:32:29PM +0800, Pingfan Liu wrote: > > > FOLL_LONGTERM suggests a pin which is going to be given to hardware and > > > can't move. It would truncate CMA permanently and should be excluded. > > > > > > FOLL_LONGTERM has already been checked in the slow path, but not checked in > > > the fast path, which means a possible leak of CMA page to longterm pinned > > > requirement through this crack. > > > > > > Place a check in try_get_compound_head() in the fast path. > > > > > > Some note about the check: > > > Huge page's subpages have the same migrate type due to either > > > allocation from a free_list[] or alloc_contig_range() with param > > > MIGRATE_MOVABLE. So it is enough to check on a single subpage > > > by is_migrate_cma_page(subpage) > > > > > > Signed-off-by: Pingfan Liu > > > Cc: Ira Weiny > > > Cc: Andrew Morton > > > Cc: Mike Rapoport > > > Cc: Dan Williams > > > Cc: Matthew Wilcox > > > Cc: John Hubbard > > > Cc: "Aneesh Kumar K.V" > > > Cc: Keith Busch > > > Cc: Christoph Hellwig > > > Cc: Shuah Khan > > > To: linux-mm@kvack.org > > > Cc: linux-kernel@vger.kernel.org > > > mm/gup.c | 26 +++++++++++++++++++------- > > > 1 file changed, 19 insertions(+), 7 deletions(-) > > > > > > diff --git a/mm/gup.c b/mm/gup.c > > > index cd8075e..f0d6804 100644 > > > +++ b/mm/gup.c > > > @@ -33,9 +33,21 @@ struct follow_page_context { > > > * Return the compound head page with ref appropriately incremented, > > > * or NULL if that failed. > > > */ > > > -static inline struct page *try_get_compound_head(struct page *page, int refs) > > > +static inline struct page *try_get_compound_head(struct page *page, int refs, > > > + unsigned int flags) > > > { > > > - struct page *head = compound_head(page); > > > + struct page *head; > > > + > > > + /* > > > + * Huge page's subpages have the same migrate type due to either > > > + * allocation from a free_list[] or alloc_contig_range() with param > > > + * MIGRATE_MOVABLE. So it is enough to check on a single subpage. > > > + */ > > > + if (unlikely(flags & FOLL_LONGTERM) && > > > + is_migrate_cma_page(page)) > > > + return NULL; > > > > This doesn't seem very good actually. > > > > If I understand properly, if the system has randomly decided to place, > > say, an anonymous page in a CMA region when an application did mmap(), > > then when the application tries to use this page with a LONGTERM pin > > it gets an immediate failure because of the above. > No, actually, it will fall back to slow path, which migrates and sever > the LONGTERM pin. > > This patch just aims to fix the leakage in gup fast path, while in gup > slow path, there is already logic to guard CMA against LONGTERM pin. > > > > This not OK - the application should not be subject to random failures > > related to long term pins beyond its direct control. > > > > Essentially, failures should only originate from the application using > > specific mmap scenarios, not randomly based on something the MM did, > > and certainly never for anonymous memory. > > > > I think the correct action here is to trigger migration of the page so > > it is not in CMA. > In fact, it does this. The failure in gup fast path will fall back to > slow path, where __gup_longterm_locked->check_and_migrate_cma_pages() > does the migration. It is probably worth revising the commit message so this flow is clear Jason