| Message ID | 20230801124844.278698-3-david@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | smaps / mm/gup: fix gup_can_follow_protnone fallout | expand |
On Tue, Aug 01, 2023 at 02:48:38PM +0200, David Hildenbrand wrote: > We shouldn't be using a GUP-internal helper if it can be avoided. > > Similar to smaps_pte_entry() that uses vm_normal_page(), let's use > vm_normal_page_pmd() that similarly refuses to return the huge zeropage. > > In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd(): > > (1) Will always return the head page, not a tail page of a THP. > > If we'd ever call smaps_account with a tail page while setting "compound > = true", we could be in trouble, because smaps_account() would look at > the memmap of unrelated pages. > > If we're unlucky, that memmap does not exist at all. Before we removed > PG_doublemap, we could have triggered something similar as in > commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for > migration entry"). > > This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc: > smaps_rollup: do not stall write attempts on mmap_lock"): > > (a) We're in show_smaps_rollup() and processed a VMA > (b) We release the mmap lock in show_smaps_rollup() because it is > contended > (c) We merged that VMA with another VMA > (d) We collapsed a THP in that merged VMA at that position > > If the end address of the original VMA falls into the middle of a THP > area, we would call smap_gather_stats() with a start address that falls > into a PMD-mapped THP. It's probably very rare to trigger when not > really forced. > > (2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page() > > Treat such PMDs here just like smaps_pte_entry() would treat such PTEs. > If such pages would be anonymous, we most certainly would want to > account them. > > (3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap() > > As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE > pages. So just like smaps_pte_entry(), we'll now also ignore such PMD > entries. > > Especially, follow_pmd_mask() never ends up calling > follow_trans_huge_pmd() on pmd_devmap(). Instead it calls > follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN > is set. > > So skipping pmd_devmap() pages seems to be the right thing to do. > > (4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page() > > We won't be returning a memmap that should be ignored by core-mm, or > worse, a memmap that does not even exist. Note that while > walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't. > > Most probably this case doesn't currently really happen on the PMD level, > otherwise we'd already be able to trigger kernel crashes when reading > smaps / smaps_rollup. > > So most probably only (1) is relevant in practice as of now, but could only > cause trouble in extreme corner cases. > > Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock") > Signed-off-by: David Hildenbrand <david@redhat.com> Maybe move the follow_trans_huge_pmd() declaration from linux/huge_mm.h to mm/internal.h to discourage future mistakes? Otherwise Acked-by: Mel Gorman <mgorman@techsingularity.net>
On 02.08.23 17:16, Mel Gorman wrote: > On Tue, Aug 01, 2023 at 02:48:38PM +0200, David Hildenbrand wrote: >> We shouldn't be using a GUP-internal helper if it can be avoided. >> >> Similar to smaps_pte_entry() that uses vm_normal_page(), let's use >> vm_normal_page_pmd() that similarly refuses to return the huge zeropage. >> >> In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd(): >> >> (1) Will always return the head page, not a tail page of a THP. >> >> If we'd ever call smaps_account with a tail page while setting "compound >> = true", we could be in trouble, because smaps_account() would look at >> the memmap of unrelated pages. >> >> If we're unlucky, that memmap does not exist at all. Before we removed >> PG_doublemap, we could have triggered something similar as in >> commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for >> migration entry"). >> >> This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc: >> smaps_rollup: do not stall write attempts on mmap_lock"): >> >> (a) We're in show_smaps_rollup() and processed a VMA >> (b) We release the mmap lock in show_smaps_rollup() because it is >> contended >> (c) We merged that VMA with another VMA >> (d) We collapsed a THP in that merged VMA at that position >> >> If the end address of the original VMA falls into the middle of a THP >> area, we would call smap_gather_stats() with a start address that falls >> into a PMD-mapped THP. It's probably very rare to trigger when not >> really forced. >> >> (2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page() >> >> Treat such PMDs here just like smaps_pte_entry() would treat such PTEs. >> If such pages would be anonymous, we most certainly would want to >> account them. >> >> (3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap() >> >> As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE >> pages. So just like smaps_pte_entry(), we'll now also ignore such PMD >> entries. >> >> Especially, follow_pmd_mask() never ends up calling >> follow_trans_huge_pmd() on pmd_devmap(). Instead it calls >> follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN >> is set. >> >> So skipping pmd_devmap() pages seems to be the right thing to do. >> >> (4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page() >> >> We won't be returning a memmap that should be ignored by core-mm, or >> worse, a memmap that does not even exist. Note that while >> walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't. >> >> Most probably this case doesn't currently really happen on the PMD level, >> otherwise we'd already be able to trigger kernel crashes when reading >> smaps / smaps_rollup. >> >> So most probably only (1) is relevant in practice as of now, but could only >> cause trouble in extreme corner cases. >> >> Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock") >> Signed-off-by: David Hildenbrand <david@redhat.com> > > Maybe move the follow_trans_huge_pmd() declaration from linux/huge_mm.h > to mm/internal.h to discourage future mistakes? Otherwise > Makes sense. > Acked-by: Mel Gorman <mgorman@techsingularity.net> Thanks!
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index bf25178ae66a..7a7d6e2e6a14 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -571,8 +571,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr, bool migration = false; if (pmd_present(*pmd)) { - /* FOLL_DUMP will return -EFAULT on huge zero page */ - page = follow_trans_huge_pmd(vma, addr, pmd, FOLL_DUMP); + page = vm_normal_page_pmd(vma, addr, *pmd); } else if (unlikely(thp_migration_supported() && is_swap_pmd(*pmd))) { swp_entry_t entry = pmd_to_swp_entry(*pmd);
We shouldn't be using a GUP-internal helper if it can be avoided. Similar to smaps_pte_entry() that uses vm_normal_page(), let's use vm_normal_page_pmd() that similarly refuses to return the huge zeropage. In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd(): (1) Will always return the head page, not a tail page of a THP. If we'd ever call smaps_account with a tail page while setting "compound = true", we could be in trouble, because smaps_account() would look at the memmap of unrelated pages. If we're unlucky, that memmap does not exist at all. Before we removed PG_doublemap, we could have triggered something similar as in commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for migration entry"). This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock"): (a) We're in show_smaps_rollup() and processed a VMA (b) We release the mmap lock in show_smaps_rollup() because it is contended (c) We merged that VMA with another VMA (d) We collapsed a THP in that merged VMA at that position If the end address of the original VMA falls into the middle of a THP area, we would call smap_gather_stats() with a start address that falls into a PMD-mapped THP. It's probably very rare to trigger when not really forced. (2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page() Treat such PMDs here just like smaps_pte_entry() would treat such PTEs. If such pages would be anonymous, we most certainly would want to account them. (3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap() As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE pages. So just like smaps_pte_entry(), we'll now also ignore such PMD entries. Especially, follow_pmd_mask() never ends up calling follow_trans_huge_pmd() on pmd_devmap(). Instead it calls follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN is set. So skipping pmd_devmap() pages seems to be the right thing to do. (4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page() We won't be returning a memmap that should be ignored by core-mm, or worse, a memmap that does not even exist. Note that while walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't. Most probably this case doesn't currently really happen on the PMD level, otherwise we'd already be able to trigger kernel crashes when reading smaps / smaps_rollup. So most probably only (1) is relevant in practice as of now, but could only cause trouble in extreme corner cases. Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock") Signed-off-by: David Hildenbrand <david@redhat.com> --- fs/proc/task_mmu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)