Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 27 Nov 2017 14:42:49 +0200
From:   Mike Rapoport <rppt@linux.vnet.ibm.com>
To:     Michal Hocko <mhocko@kernel.org>
Cc:     guoxuenan <guoxuenan@huawei.com>, akpm@linux-foundation.org,
        minchan@kernel.org, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, yi.zhang@huawei.com,
        miaoxie@huawei.com, shli@fb.com, aarcange@redhat.com,
        mgorman@techsingularity.net, kirill.shutemov@linux.intel.com,
        rientjes@google.com, khandual@linux.vnet.ibm.com, riel@redhat.com
Subject: Re: [PATCH] mm,madvise: bugfix of madvise systemcall infinite loop
 under special circumstances.
References: <20171127115318.911-1-guoxuenan@huawei.com>
 <20171127115847.7b65btmfl762552d@dhcp22.suse.cz>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20171127115847.7b65btmfl762552d@dhcp22.suse.cz>
User-Agent: Mutt/1.5.24 (2015-08-30)
Message-Id: <20171127124248.GA10946@rapoport-lnx>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Nov 27, 2017 at 12:58:47PM +0100, Michal Hocko wrote:
> On Mon 27-11-17 19:53:18, guoxuenan wrote:
> > From: chenjie <chenjie6@huawei.com>
> > 
> > The madvise() system call supported a set of "conventional" advice values,
> > the MADV_WILLNEED parameter has possibility of triggering an infinite loop under
> > direct access mode(DAX).
> > 
> > Infinite loop situation:
> > 1、initial state [ start = vam->vm_start < vam->vm_end < end ].
> > 2、madvise_vma() using MADV_WILLNEED parameter;
> >    madvise_vma() -> madvise_willneed() -> return 0 && the value of [prev] is not updated.
> > 
> > In function SYSCALL_DEFINE3(madvise,...)
> > When [start = vam->vm_start] the program enters "for" loop,
> > find_vma_prev() will set the pointer vma and the pointer prev(prev = vam->vm_prev).
> > Normally ,madvise_vma() will always move the pointer prev ,but when use DAX mode,
> > it will never update the value of [prev].
> > 
> > =======================================================================
> > SYSCALL_DEFINE3(madvise,...)
> > {
> > 	[...]
> > 	//start = vam->start  => prev=vma->prev
> >     vma = find_vma_prev(current->mm, start, &prev);
> > 	[...]
> > 	for(;;)
> > 	{
> > 	      update [start = vma->vm_start]
> > 
> > 	con0: if (start >= end)                 //false always;
> > 	    goto out;
> > 	       tmp = vma->vm_end;
> > 
> > 	//do not update [prev] and always return 0;
> > 	       error = madvise_willneed();
> > 
> > 	con1: if (error)                        //false always;
> > 	    goto out;
> > 
> > 	//[ vam->vm_start < start = vam->vm_end  <end ]
> > 	       update [start = tmp ]
> > 
> > 	con2: if (start >= end)                 //false always ;
> > 	    goto out;
> > 
> > 	//because of pointer [prev] did not change,[vma] keep as it was;
> > 	       update [ vma = prev->vm_next ]
> > 	}
> > 	[...]
> > }
> > =======================================================================
> > After the first cycle ;it will always keep
> > vam->vm_start < start = vam->vm_end  < end  && vma = prev->vm_next;
> > since Circulation exit conditions (con{0,1,2}) will never meet ,the
> > program stuck in infinite loop.
> 
> I find your changelog a bit hard to parse. What would you think about
> the following:
> "
> MADVISE_WILLNEED has always been a noop for DAX (formerly XIP) mappings.
> Unfortunatelly madvise_willneed doesn't communicate this information
> properly to the generic madvise syscall implementation. The calling
> converion is quite subtle there. madvise_vma is supposed to either

spelling: "The calling convention"

> return an error or update &prev otherwise the main loop will never
> advance to the next vma and it will keep looping for ever without a way
> to get out of the kernel.
> 
> It seems this has been broken since introduced. Nobody has noticed
> because nobody seems to be using MADVISE_WILLNEED on these DAX mappings.
> 
> Fixes: fe77ba6f4f97 ("[PATCH] xip: madvice/fadvice: execute in place")
> Cc: stable
> "
> 
> > Signed-off-by: chenjie <chenjie6@huawei.com>
> > Signed-off-by: guoxuenan <guoxuenan@huawei.com>
> 
> Other than that
> Acked-by: Michal Hocko <mhocko@suse.com>
> 
> > ---
> >  mm/madvise.c | 4 +---
> >  1 file changed, 1 insertion(+), 3 deletions(-)
> > 
> > diff --git a/mm/madvise.c b/mm/madvise.c
> > index 375cf32..751e97a 100644
> > --- a/mm/madvise.c
> > +++ b/mm/madvise.c
> > @@ -276,15 +276,14 @@ static long madvise_willneed(struct vm_area_struct *vma,
> >  {
> >  	struct file *file = vma->vm_file;
> >  
> > +	*prev = vma;
> >  #ifdef CONFIG_SWAP
> >  	if (!file) {
> > -		*prev = vma;
> >  		force_swapin_readahead(vma, start, end);
> >  		return 0;
> >  	}
> >  
> >  	if (shmem_mapping(file->f_mapping)) {
> > -		*prev = vma;
> >  		force_shm_swapin_readahead(vma, start, end,
> >  					file->f_mapping);
> >  		return 0;
> > @@ -299,7 +298,6 @@ static long madvise_willneed(struct vm_area_struct *vma,
> >  		return 0;
> >  	}
> >  
> > -	*prev = vma;
> >  	start = ((start - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
> >  	if (end > vma->vm_end)
> >  		end = vma->vm_end;
> > -- 
> > 2.9.5
> > 
> 
> -- 
> Michal Hocko
> SUSE Labs
> 

-- 
Sincerely yours,
Mike.


From 1585222369662099911@xxx Mon Nov 27 12:30:59 +0000 2017
X-GM-THRID: 1585219652332388182
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread