Received: by 2002:a05:6a11:4021:0:0:0:0 with SMTP id ky33csp915369pxb; Wed, 29 Sep 2021 12:24:48 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzbgidibzXjrJ7mCZvV7enCDwyDiEmfglADQ1jMyazykYjRWa5JsP6ykn/tLj3oHz59WRiz X-Received: by 2002:a17:90b:2358:: with SMTP id ms24mr6764111pjb.1.1632943488214; Wed, 29 Sep 2021 12:24:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1632943488; cv=none; d=google.com; s=arc-20160816; b=tkY7vQqH1D1CRwJNqGCdjA6fuUeMQNtLz8baTAWlgRgFPN9yWgRFo1pFJKr328aSo4 OyM02rq83CUeX61beOb9Yd1jg7aDxWXvupZPM82suEoxkxZeaRV8mpeJT0eO3OtBdPrb PXml/S1DWv1VTwyhlezufQ897sj+GkbW9PN4/DkoKiQ3hFy+jwYLpU8dYaqfpsVANJTS py+0vKl3QfA0JcS0eQsU8rEyxybKMGuUV0H7dOzMqDnjelWaqITqqa/cuiMyApckdrhh vbpa7YIeZzAgVaiZaZC43BqBM5ZhfaWHOlrbt0/lNFp7PBTbGdIRJCRoxZylXYKOZ9jx ugBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-transfer-encoding :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:dkim-signature; bh=PBrItrWYc4exfbDaKqyby4f2f1oZNsNLet5vMQY77Po=; b=uId20Xnjir/sWajVsmVIfQcrMU2aY4xXFK+zEwB3yw313sNoABAr7hTgi2nLr2JHFT wkTJbFjylozmTag20FvHxQs4dlRrLi9MoGSNpPCsp3UwVYZThd4epzK3V6I2xVcIiK56 mjAOHQmjC2sZdVBlToydxyaA5926p25pqBaJIPyZRgS6dLYvsRbvDEoaGOcbJpcRls/j DHUF7NANaJe2SHD5tHl4uWQ79kFzx+Ay+nskX7FuRrXZ8NGVai2Uo3hZKlV3j11kmanr L1YMK1kyLmYyqkhejoS1E0KoPENbZPLE7V3j2SmzMvEoAwfcem1dL1GjbzUc3KSdXj5N GnpA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@infradead.org header.s=casper.20170209 header.b=SsDrPhn3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id j15si841754pfr.243.2021.09.29.12.24.25; Wed, 29 Sep 2021 12:24:48 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@infradead.org header.s=casper.20170209 header.b=SsDrPhn3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344241AbhI2R7L (ORCPT + 99 others); Wed, 29 Sep 2021 13:59:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35788 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244878AbhI2R7K (ORCPT ); Wed, 29 Sep 2021 13:59:10 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5D3CAC06161C for ; Wed, 29 Sep 2021 10:57:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Transfer-Encoding: Content-Type:MIME-Version:References:Message-ID:Subject:Cc:To:From:Date: Sender:Reply-To:Content-ID:Content-Description; bh=PBrItrWYc4exfbDaKqyby4f2f1oZNsNLet5vMQY77Po=; b=SsDrPhn3Ek/0gG58GnPT0RGdtb t2lZlMA1e2ZxEjK7xX0YIK/91Rld17n3pmw8hNS9Tr7I0MnZHbFad9H8GDwGo4wO64u3E17G1EQ4d CSHh1GIcZ6MM2+tcvF3q+ol1dCOVzzBX2LwJNnzy21boWeloHpn6EVvHE3QLJ9J8A9rzgwuc1LmKr FbhtBAqttUz0CdWiGIR3Xu4MtrDGwaGeVmu0JYazQd/aMez5nJ+4fbF6kndcQhp2a2b8L4QglGJbQ +F3jp6w6B6oq1F1jmk8RTxc5XW/8zgudI7ZT8wduRCiGQvwA4Kxf3s158kVziu+vcRpQsMFZk0Je9 fMAjc/oA==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1mVdo7-00C5Pm-EU; Wed, 29 Sep 2021 17:56:06 +0000 Date: Wed, 29 Sep 2021 18:55:51 +0100 From: Matthew Wilcox To: Song Liu Cc: Rongwei Wang , Andrew Morton , Linux MM , Linux Kernel Mailing List , William Kucharski , Hugh Dickins Subject: Re: [PATCH v2 1/2] mm, thp: check page mapping when truncating page cache Message-ID: References: <20210922070645.47345-2-rongwei.wang@linux.alibaba.com> <20210923194343.ca0f29e1c4d361170343a6f2@linux-foundation.org> <9e41661d-9919-d556-8c49-610dae157553@linux.alibaba.com> <68737431-01d2-e6e3-5131-7d7c731e49ae@linux.alibaba.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Sep 29, 2021 at 09:59:38AM -0700, Song Liu wrote: > On Wed, Sep 29, 2021 at 12:50 AM Rongwei Wang > wrote: > > > > > > > > On 9/29/21 3:14 PM, Song Liu wrote: > > > On Tue, Sep 28, 2021 at 9:20 AM Rongwei Wang > > > wrote: > > >> > > >> > > >> > > >> On 9/28/21 6:24 AM, Song Liu wrote: > > >>> On Fri, Sep 24, 2021 at 12:12 AM Rongwei Wang > > >>> wrote: > > >>>> > > >>>> > > >>>> > > >>>> On 9/24/21 10:43 AM, Andrew Morton wrote: > > >>>>> On Thu, 23 Sep 2021 01:04:54 +0800 Rongwei Wang wrote: > > >>>>> > > >>>>>> > > >>>>>> > > >>>>>>> On Sep 22, 2021, at 7:37 PM, Matthew Wilcox wrote: > > >>>>>>> > > >>>>>>> On Wed, Sep 22, 2021 at 03:06:44PM +0800, Rongwei Wang wrote: > > >>>>>>>> Transparent huge page has supported read-only non-shmem files. The file- > > >>>>>>>> backed THP is collapsed by khugepaged and truncated when written (for > > >>>>>>>> shared libraries). > > >>>>>>>> > > >>>>>>>> However, there is race in two possible places. > > >>>>>>>> > > >>>>>>>> 1) multiple writers truncate the same page cache concurrently; > > >>>>>>>> 2) collapse_file rolls back when writer truncates the page cache; > > >>>>>>> > > >>>>>>> As I've said before, the bug here is that somehow there is a writable fd > > >>>>>>> to a file with THPs. That's what we need to track down and fix. > > >>>>>> Hi, Matthew > > >>>>>> I am not sure get your means. We know “mm, thp: relax the VM_DENYWRITE constraint on file-backed THPs" > > >>>>>> Introduced file-backed THPs for DSO. It is possible {very rarely} for DSO to be opened in writeable way. > > >>>>>> > > >>>>>> ... > > >>>>>> > > >>>>>>> https://lore.kernel.org/linux-mm/YUdL3lFLFHzC80Wt@casper.infradead.org/ > > >>>>>> All in all, what you mean is that we should solve this race at the source? > > >>>>> > > >>>>> Matthew is being pretty clear here: we shouldn't be permitting > > >>>>> userspace to get a writeable fd for a thp-backed file. > > >>>>> > > >>>>> Why are we permitting the DSO to be opened writeably? If there's a > > >>>>> legitimate case for doing this then presumably "mm, thp: relax the > > >>>> There is a use case to stress file-backed THP within attachment. > > >>>> I test this case in a system which has enabled CONFIG_READ_ONLY_THP_FOR_FS: > > >>>> > > >>>> $ gcc -Wall -g -o stress_madvise_dso stress_madvise_dso.c > > >>>> $ ulimit -s unlimited > > >>>> $ ./stress_madvise_dso 10000 > > >>>> > > >>>> the meaning of above parameters: > > >>>> 10000: the max test time; > > >>>> : the DSO that will been mapped into file-backed THP by > > >>>> madvise. It recommended that the text segment of DSO to be tested is > > >>>> greater than 2M. > > >>>> > > >>>> The crash will been triggered at once in the latest kernel. And this > > >>>> case also can used to trigger the bug that mentioned in our another patch. > > >>> > > >>> Hmm.. I am not able to use the repro program to crash the system. Not > > >>> sure what I did wrong. > > >>> > > >> Hi > > >> I have tried to check my test case again. Can you make sure the DSO that > > >> you test have THP mapping? > > >> > > >> If you are willing to try again, I can send my libtest.c which is used > > >> to test by myself (actually, it shouldn't be target DSO problem). > > >> > > >> Thanks very much! > > >>> OTOH, does it make sense to block writes within khugepaged, like: > > >>> > > >>> diff --git i/mm/khugepaged.c w/mm/khugepaged.c > > >>> index 045cc579f724e..ad7c41ec15027 100644 > > >>> --- i/mm/khugepaged.c > > >>> +++ w/mm/khugepaged.c > > >>> @@ -51,6 +51,7 @@ enum scan_result { > > >>> SCAN_CGROUP_CHARGE_FAIL, > > >>> SCAN_TRUNCATED, > > >>> SCAN_PAGE_HAS_PRIVATE, > > >>> + SCAN_BUSY_WRITE, > > >>> }; > > >>> > > >>> #define CREATE_TRACE_POINTS > > >>> @@ -1652,6 +1653,11 @@ static void collapse_file(struct mm_struct *mm, > > >>> /* Only allocate from the target node */ > > >>> gfp = alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; > > >>> > > >>> + if (deny_write_access(file)) { > > >>> + result = SCAN_BUSY_WRITE; > > >>> + return; > > >>> + } > > >>> + > > >> This can indeed avoid some possible races from source. > > >> > > >> But, I am thinking about whether this will lead to DDoS attack? > > >> I remember the reason of DSO has ignored MAP_DENYWRITE in kernel > > >> is that DDoS attack. In addition, 'deny_write_access' will change > > >> the behavior, such as user will get 'Text file busy' during > > >> collapse_file. I am not sure whether the behavior changing is acceptable > > >> in user space. > > >> > > >> If it is acceptable, I am very willing to fix the races like your way. > > > > > > I guess we should not let the write get ETXTBUSY for khugepaged work. > > > > > > I am getting some segfault on stress_madvise_dso. And it doesn't really > > > generate the bug stack in my vm (qemu-system-x86_64). Is there an newer > > Hi, I can sure I am not update the stress_madvise_dso.c. > > > > My test environment is vm (qemu-system-aarch64, 32 cores). And I can > > think of the following possibilities: > > > > (1) in thread_read() > > > > printf("read %s\n", dso_path); > > d = open(dso_path, O_RDONLY); > > /* The start addr must be alignment with 2M */ > > void *p = mmap((void *)0x40000dc00000UL, 0x800000, PROT_READ | > > PROT_EXEC,MAP_PRIVATE, fd, 0); > > if (p == MAP_FAILED) { > > perror("mmap"); > > goto out; > > } > > > > 0x40000dc00000 is random setting by myself. I am not sure this address > > is available in your vm. > > > > (2) in thread_write() > > int fd = open(dso_path, O_RDWR); > > p = mmap(NULL, 0x800000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); > > if (p == MAP_FAILED) { > > perror("mmap"); > > goto out; /* fail */ > > } > > > > because of I am sure the DSO is bigger than 0x800000, so directly map > > the DSO using 0x800000. Maybe I had use '-z max-page-size=0x200000' to > > compile the DSO? likes: > > $ gcc -z max-page-size=0x200000 -o libtest.so -shared libtest.o > > > > If you don't mind, you can send the segment fault log to me. And I will > > find x86 environment to test. > > I fixed the segfault with > 1. malloc buf (as it is too big for stack) in thread_read > 2. reduce memcpy() size in thread_read. > > Now, I am able to crash the system on > find_lock_entries () { > ... > VM_BUG_ON_PAGE(page->index != xas.xa_index, page); > } > I guess it is related. I will test more. That's a bogus VM_BUG_ON. I have a patch in my tree to delete it. Andrew has it too, but for some reason, he hasn't sent it on to Linus. +++ b/mm/filemap.c @@ -2093,7 +2093,6 @@ unsigned find_lock_entries(struct address_space *mapping, pgoff_t start, if (!xa_is_value(page)) { if (page->index < start) goto put; - VM_BUG_ON_PAGE(page->index != xas.xa_index, page); if (page->index + thp_nr_pages(page) - 1 > end) goto put; if (!trylock_page(page))