From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA8FBC433F5 for ; Tue, 28 Sep 2021 16:20:30 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8109B61206 for ; Tue, 28 Sep 2021 16:20:30 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 8109B61206 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 138A36B006C; Tue, 28 Sep 2021 12:20:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0C25A940007; Tue, 28 Sep 2021 12:20:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EA4F9900002; Tue, 28 Sep 2021 12:20:29 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0098.hostedemail.com [216.40.44.98]) by kanga.kvack.org (Postfix) with ESMTP id D7EC26B006C for ; Tue, 28 Sep 2021 12:20:29 -0400 (EDT) Received: from smtpin13.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 7AE2D32633 for ; Tue, 28 Sep 2021 16:20:29 +0000 (UTC) X-FDA: 78637494978.13.0380A61 Received: from out4436.biz.mail.alibaba.com (out4436.biz.mail.alibaba.com [47.88.44.36]) by imf23.hostedemail.com (Postfix) with ESMTP id 54F6F90000AC for ; Tue, 28 Sep 2021 16:20:26 +0000 (UTC) X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R101e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e01e04395;MF=rongwei.wang@linux.alibaba.com;NM=1;PH=DS;RN=7;SR=0;TI=SMTPD_---0UpxbQ2i_1632846023; Received: from 30.30.67.189(mailfrom:rongwei.wang@linux.alibaba.com fp:SMTPD_---0UpxbQ2i_1632846023) by smtp.aliyun-inc.com(127.0.0.1); Wed, 29 Sep 2021 00:20:24 +0800 Content-Type: multipart/mixed; boundary="------------gsvJybHFweo94iGjbSJjNOSO" Message-ID: <68737431-01d2-e6e3-5131-7d7c731e49ae@linux.alibaba.com> Date: Wed, 29 Sep 2021 00:20:22 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:93.0) Gecko/20100101 Thunderbird/93.0 Subject: Re: [PATCH v2 1/2] mm, thp: check page mapping when truncating page cache Content-Language: en-US To: Song Liu Cc: Andrew Morton , Matthew Wilcox , Linux MM , Linux Kernel Mailing List , William Kucharski , Hugh Dickins References: <20210906121200.57905-1-rongwei.wang@linux.alibaba.com> <20210922070645.47345-2-rongwei.wang@linux.alibaba.com> <20210923194343.ca0f29e1c4d361170343a6f2@linux-foundation.org> <9e41661d-9919-d556-8c49-610dae157553@linux.alibaba.com> From: Rongwei Wang In-Reply-To: X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 54F6F90000AC X-Stat-Signature: id8uoc5hrozgjmg65z6e5x3mtbnswhqz Authentication-Results: imf23.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=alibaba.com; spf=pass (imf23.hostedemail.com: domain of rongwei.wang@linux.alibaba.com designates 47.88.44.36 as permitted sender) smtp.mailfrom=rongwei.wang@linux.alibaba.com X-HE-Tag: 1632846026-629558 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: This is a multi-part message in MIME format. --------------gsvJybHFweo94iGjbSJjNOSO Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable On 9/28/21 6:24 AM, Song Liu wrote: > On Fri, Sep 24, 2021 at 12:12 AM Rongwei Wang > wrote: >> >> >> >> On 9/24/21 10:43 AM, Andrew Morton wrote: >>> On Thu, 23 Sep 2021 01:04:54 +0800 Rongwei Wang wrote: >>> >>>> >>>> >>>>> On Sep 22, 2021, at 7:37 PM, Matthew Wilcox w= rote: >>>>> >>>>> On Wed, Sep 22, 2021 at 03:06:44PM +0800, Rongwei Wang wrote: >>>>>> Transparent huge page has supported read-only non-shmem files. The= file- >>>>>> backed THP is collapsed by khugepaged and truncated when written (= for >>>>>> shared libraries). >>>>>> >>>>>> However, there is race in two possible places. >>>>>> >>>>>> 1) multiple writers truncate the same page cache concurrently; >>>>>> 2) collapse_file rolls back when writer truncates the page cache; >>>>> >>>>> As I've said before, the bug here is that somehow there is a writab= le fd >>>>> to a file with THPs. That's what we need to track down and fix. >>>> Hi, Matthew >>>> I am not sure get your means. We know =E2=80=9Cmm, thp: relax the VM= _DENYWRITE constraint on file-backed THPs" >>>> Introduced file-backed THPs for DSO. It is possible {very rarely} fo= r DSO to be opened in writeable way. >>>> >>>> ... >>>> >>>>> https://lore.kernel.org/linux-mm/YUdL3lFLFHzC80Wt@casper.infradead.= org/ >>>> All in all, what you mean is that we should solve this race at the s= ource? >>> >>> Matthew is being pretty clear here: we shouldn't be permitting >>> userspace to get a writeable fd for a thp-backed file. >>> >>> Why are we permitting the DSO to be opened writeably? If there's a >>> legitimate case for doing this then presumably "mm, thp: relax the >> There is a use case to stress file-backed THP within attachment. >> I test this case in a system which has enabled CONFIG_READ_ONLY_THP_FO= R_FS: >> >> $ gcc -Wall -g -o stress_madvise_dso stress_madvise_dso.c >> $ ulimit -s unlimited >> $ ./stress_madvise_dso 10000 >> >> the meaning of above parameters: >> 10000: the max test time; >> : the DSO that will been mapped into file-backed THP by >> madvise. It recommended that the text segment of DSO to be tested is >> greater than 2M. >> >> The crash will been triggered at once in the latest kernel. And this >> case also can used to trigger the bug that mentioned in our another pa= tch. >=20 > Hmm.. I am not able to use the repro program to crash the system. Not > sure what I did wrong. >=20 Hi I have tried to check my test case again. Can you make sure the DSO that=20 you test have THP mapping? If you are willing to try again, I can send my libtest.c which is used=20 to test by myself (actually, it shouldn't be target DSO problem). Thanks very much! > OTOH, does it make sense to block writes within khugepaged, like: >=20 > diff --git i/mm/khugepaged.c w/mm/khugepaged.c > index 045cc579f724e..ad7c41ec15027 100644 > --- i/mm/khugepaged.c > +++ w/mm/khugepaged.c > @@ -51,6 +51,7 @@ enum scan_result { > SCAN_CGROUP_CHARGE_FAIL, > SCAN_TRUNCATED, > SCAN_PAGE_HAS_PRIVATE, > + SCAN_BUSY_WRITE, > }; >=20 > #define CREATE_TRACE_POINTS > @@ -1652,6 +1653,11 @@ static void collapse_file(struct mm_struct *mm, > /* Only allocate from the target node */ > gfp =3D alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; >=20 > + if (deny_write_access(file)) { > + result =3D SCAN_BUSY_WRITE; > + return; > + } > + This can indeed avoid some possible races from source. But, I am thinking about whether this will lead to DDoS attack? I remember the reason of DSO has ignored MAP_DENYWRITE in kernel is that DDoS attack. In addition, 'deny_write_access' will change the behavior, such as user will get 'Text file busy' during=20 collapse_file. I am not sure whether the behavior changing is acceptable=20 in user space. If it is acceptable, I am very willing to fix the races like your way. Thanks! > new_page =3D khugepaged_alloc_page(hpage, gfp, node); > if (!new_page) { > result =3D SCAN_ALLOC_HUGE_PAGE_FAIL; > @@ -1863,19 +1869,6 @@ static void collapse_file(struct mm_struct *mm, > else { > __mod_lruvec_page_state(new_page, NR_FILE_THPS, nr); > filemap_nr_thps_inc(mapping); > - /* > - * Paired with smp_mb() in do_dentry_open() to ensure > - * i_writecount is up to date and the update to nr_thps= is > - * visible. Ensures the page cache will be truncated if= the > - * file is opened writable. > - */ > - smp_mb(); > - if (inode_is_open_for_write(mapping->host)) { > - result =3D SCAN_FAIL; > - __mod_lruvec_page_state(new_page, NR_FILE_THPS,= -nr); > - filemap_nr_thps_dec(mapping); > - goto xa_locked; > - } > } >=20 > if (nr_none) { > @@ -1976,6 +1969,7 @@ static void collapse_file(struct mm_struct *mm, > VM_BUG_ON(!list_empty(&pagelist)); > if (!IS_ERR_OR_NULL(*hpage)) > mem_cgroup_uncharge(*hpage); > + allow_write_access(file); > /* TODO: tracepoints */ > } >=20 --------------gsvJybHFweo94iGjbSJjNOSO Content-Type: text/plain; charset=UTF-8; name="libtest.c" Content-Disposition: attachment; filename="libtest.c" Content-Transfer-Encoding: base64 I2lmbmRlZiBfREVGQVVMVF9TT1VSQ0UKI2RlZmluZSBfREVGQVVMVF9TT1VSQ0UKI2VuZGlm CgojaW5jbHVkZSA8ZmNudGwuaD4KI2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdGRs aWIuaD4KI2luY2x1ZGUgPHN0cmluZy5oPgojaW5jbHVkZSA8c3lzL21tYW4uaD4KI2luY2x1 ZGUgPHVuaXN0ZC5oPgoKLyogInZvbGF0aWxlIiB0byBmb3JiaWQgY29tcGlsZXIgb3B0aW1p emF0aW9uICovCnZvbGF0aWxlIHN0YXRpYyBpbnQgeDsKCiNkZWZpbmUgRE9fMCArK3g7CiNk ZWZpbmUgRE9fMSB7RE9fMDsgRE9fMDsgRE9fMDsgRE9fMDsgRE9fMDsgRE9fMDsgRE9fMDsg RE9fMDsgRE9fMH0KI2RlZmluZSBET18yIHtET18xOyBET18xOyBET18xOyBET18xOyBET18x OyBET18xOyBET18xOyBET18xOyBET18xfQojZGVmaW5lIERPXzMge0RPXzI7IERPXzI7IERP XzI7IERPXzI7IERPXzI7IERPXzI7IERPXzI7IERPXzI7IERPXzJ9CiNkZWZpbmUgRE9fNCB7 RE9fMzsgRE9fMzsgRE9fMzsgRE9fMzsgRE9fMzsgRE9fMzsgRE9fMzsgRE9fMzsgRE9fM30K I2RlZmluZSBET181IHtET180OyBET180OyBET180OyBET180OyBET180OyBET180OyBET180 OyBET180OyBET180fQojZGVmaW5lIERPXzYge0RPXzU7IERPXzU7IERPXzU7IERPXzU7IERP XzU7IERPXzU7IERPXzU7IERPXzU7IERPXzV9CiNkZWZpbmUgRE9fNyB7RE9fNjsgRE9fNjsg RE9fNjsgRE9fNjsgRE9fNjsgRE9fNjsgRE9fNjsgRE9fNjsgRE9fNn0KCnZvaWQgbGlidGVz dF93b3JrMSh2b2lkKQp7CglwcmludGYoIndvcmsgMVxuIik7CglET18wOwp9Cgp2b2lkIGxp YnRlc3Rfd29yazIodm9pZCkKewoJcHJpbnRmKCJ3b3JrIDJcbiIpOwoJRE9fMjsKfQoKdm9p ZCBsaWJ0ZXN0X3dvcmszKHZvaWQpCnsKCXByaW50Zigid29yayAzXG4iKTsKCURPXzQ7Cn0K CnZvaWQgbGlidGVzdF93b3JrNCh2b2lkKQp7CglwcmludGYoIndvcmsgNFxuIik7CglET182 Owp9Cg== --------------gsvJybHFweo94iGjbSJjNOSO--