From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 389B7C4332F for ; Wed, 29 Sep 2021 07:14:41 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id BC162613C8 for ; Wed, 29 Sep 2021 07:14:40 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org BC162613C8 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 2CD0B940010; Wed, 29 Sep 2021 03:14:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 25599940009; Wed, 29 Sep 2021 03:14:40 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0F5F6940010; Wed, 29 Sep 2021 03:14:40 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0205.hostedemail.com [216.40.44.205]) by kanga.kvack.org (Postfix) with ESMTP id 0151C940009 for ; Wed, 29 Sep 2021 03:14:39 -0400 (EDT) Received: from smtpin01.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id BD8FA3233B for ; Wed, 29 Sep 2021 07:14:39 +0000 (UTC) X-FDA: 78639748278.01.22242C2 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf04.hostedemail.com (Postfix) with ESMTP id 3B56550000B0 for ; Wed, 29 Sep 2021 07:14:39 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id 374E2613D3 for ; Wed, 29 Sep 2021 07:14:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1632899678; bh=TnpDtXknsRF0daBXX4GMjJz7UmGs/ymzeHvpGkHnyv8=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=LahBLs8sIBo5PN4S6snz7eYLoWY83DHuRzYiO0CxpJOteRFD2EWNXybN1O+x8N/lt DDaSzV8PgNI7c44PoGvZDw2sKeQjier4f7Yx3x1JCH2dQibG8hwMdU2smthDilz5+E BGBRLPwqZLbgHw4ZSCi9ZNErCVy1qNWVrBzB/5hZmmPahXXY0US1+C3VXFIXxMYO01 J2GYkCrT0mg6pkbcvgvcS4C5YkBURAxC13MdlY0/ZFPSoTjFdZtjd5yqKGg2kjeuwz Rr5mnu5vUVvqbDC1QVooqDzYR385ZuEE7chnLAHjvKwpoSga3guP6+s4ZyL0NNXq0A YuusZzU87BHIQ== Received: by mail-lf1-f47.google.com with SMTP id m3so6768813lfu.2 for ; Wed, 29 Sep 2021 00:14:38 -0700 (PDT) X-Gm-Message-State: AOAM530mQQW1gMv4bFZye+3b7y3voU5YOd2I5TQCC2CUJZNlQ4ub2f8M BjhjNLuZcqweYlPgnkwMo6ic0Z64YsQvU/7fU/4= X-Google-Smtp-Source: ABdhPJxETJdGuJR/uydblIRqAEZFEoAQqaRtWzs6B/JQXYxmdfes4L7TNmrf22LuVt+MCbAvNzyMUJb+WoEQFzVh7iM= X-Received: by 2002:a2e:9ad7:: with SMTP id p23mr4435158ljj.527.1632899676475; Wed, 29 Sep 2021 00:14:36 -0700 (PDT) MIME-Version: 1.0 References: <20210906121200.57905-1-rongwei.wang@linux.alibaba.com> <20210922070645.47345-2-rongwei.wang@linux.alibaba.com> <20210923194343.ca0f29e1c4d361170343a6f2@linux-foundation.org> <9e41661d-9919-d556-8c49-610dae157553@linux.alibaba.com> <68737431-01d2-e6e3-5131-7d7c731e49ae@linux.alibaba.com> In-Reply-To: <68737431-01d2-e6e3-5131-7d7c731e49ae@linux.alibaba.com> From: Song Liu Date: Wed, 29 Sep 2021 00:14:25 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH v2 1/2] mm, thp: check page mapping when truncating page cache To: Rongwei Wang Cc: Andrew Morton , Matthew Wilcox , Linux MM , Linux Kernel Mailing List , William Kucharski , Hugh Dickins Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 3B56550000B0 X-Stat-Signature: yhmb5xdwdn1mgbbowcxe8m39swt4f3nq Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=LahBLs8s; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf04.hostedemail.com: domain of song@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=song@kernel.org X-HE-Tag: 1632899679-638494 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Sep 28, 2021 at 9:20 AM Rongwei Wang wrote: > > > > On 9/28/21 6:24 AM, Song Liu wrote: > > On Fri, Sep 24, 2021 at 12:12 AM Rongwei Wang > > wrote: > >> > >> > >> > >> On 9/24/21 10:43 AM, Andrew Morton wrote: > >>> On Thu, 23 Sep 2021 01:04:54 +0800 Rongwei Wang wrote: > >>> > >>>> > >>>> > >>>>> On Sep 22, 2021, at 7:37 PM, Matthew Wilcox w= rote: > >>>>> > >>>>> On Wed, Sep 22, 2021 at 03:06:44PM +0800, Rongwei Wang wrote: > >>>>>> Transparent huge page has supported read-only non-shmem files. The= file- > >>>>>> backed THP is collapsed by khugepaged and truncated when written (= for > >>>>>> shared libraries). > >>>>>> > >>>>>> However, there is race in two possible places. > >>>>>> > >>>>>> 1) multiple writers truncate the same page cache concurrently; > >>>>>> 2) collapse_file rolls back when writer truncates the page cache; > >>>>> > >>>>> As I've said before, the bug here is that somehow there is a writab= le fd > >>>>> to a file with THPs. That's what we need to track down and fix. > >>>> Hi, Matthew > >>>> I am not sure get your means. We know =E2=80=9Cmm, thp: relax the VM= _DENYWRITE constraint on file-backed THPs" > >>>> Introduced file-backed THPs for DSO. It is possible {very rarely} fo= r DSO to be opened in writeable way. > >>>> > >>>> ... > >>>> > >>>>> https://lore.kernel.org/linux-mm/YUdL3lFLFHzC80Wt@casper.infradead.= org/ > >>>> All in all, what you mean is that we should solve this race at the s= ource? > >>> > >>> Matthew is being pretty clear here: we shouldn't be permitting > >>> userspace to get a writeable fd for a thp-backed file. > >>> > >>> Why are we permitting the DSO to be opened writeably? If there's a > >>> legitimate case for doing this then presumably "mm, thp: relax the > >> There is a use case to stress file-backed THP within attachment. > >> I test this case in a system which has enabled CONFIG_READ_ONLY_THP_FO= R_FS: > >> > >> $ gcc -Wall -g -o stress_madvise_dso stress_madvise_dso.c > >> $ ulimit -s unlimited > >> $ ./stress_madvise_dso 10000 > >> > >> the meaning of above parameters: > >> 10000: the max test time; > >> : the DSO that will been mapped into file-backed THP by > >> madvise. It recommended that the text segment of DSO to be tested is > >> greater than 2M. > >> > >> The crash will been triggered at once in the latest kernel. And this > >> case also can used to trigger the bug that mentioned in our another pa= tch. > > > > Hmm.. I am not able to use the repro program to crash the system. Not > > sure what I did wrong. > > > Hi > I have tried to check my test case again. Can you make sure the DSO that > you test have THP mapping? > > If you are willing to try again, I can send my libtest.c which is used > to test by myself (actually, it shouldn't be target DSO problem). > > Thanks very much! > > OTOH, does it make sense to block writes within khugepaged, like: > > > > diff --git i/mm/khugepaged.c w/mm/khugepaged.c > > index 045cc579f724e..ad7c41ec15027 100644 > > --- i/mm/khugepaged.c > > +++ w/mm/khugepaged.c > > @@ -51,6 +51,7 @@ enum scan_result { > > SCAN_CGROUP_CHARGE_FAIL, > > SCAN_TRUNCATED, > > SCAN_PAGE_HAS_PRIVATE, > > + SCAN_BUSY_WRITE, > > }; > > > > #define CREATE_TRACE_POINTS > > @@ -1652,6 +1653,11 @@ static void collapse_file(struct mm_struct *mm, > > /* Only allocate from the target node */ > > gfp =3D alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; > > > > + if (deny_write_access(file)) { > > + result =3D SCAN_BUSY_WRITE; > > + return; > > + } > > + > This can indeed avoid some possible races from source. > > But, I am thinking about whether this will lead to DDoS attack? > I remember the reason of DSO has ignored MAP_DENYWRITE in kernel > is that DDoS attack. In addition, 'deny_write_access' will change > the behavior, such as user will get 'Text file busy' during > collapse_file. I am not sure whether the behavior changing is acceptable > in user space. > > If it is acceptable, I am very willing to fix the races like your way. I guess we should not let the write get ETXTBUSY for khugepaged work. I am getting some segfault on stress_madvise_dso. And it doesn't really generate the bug stack in my vm (qemu-system-x86_64). Is there an newer version of it? Thanks, Song