From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932067AbbFCGQ2 (ORCPT ); Wed, 3 Jun 2015 02:16:28 -0400 Received: from lgeamrelo02.lge.com ([156.147.1.126]:56133 "EHLO lgeamrelo02.lge.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752951AbbFCGPt (ORCPT ); Wed, 3 Jun 2015 02:15:49 -0400 X-Original-SENDERIP: 10.177.222.143 X-Original-MAILFROM: minchan@kernel.org From: Minchan Kim To: Andrew Morton Cc: Hugh Dickins , Rik van Riel , Mel Gorman , Michal Hocko , Johannes Weiner , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Minchan Kim Subject: [RFC 1/6] mm: keep dirty bit on KSM page Date: Wed, 3 Jun 2015 15:15:40 +0900 Message-Id: <1433312145-19386-2-git-send-email-minchan@kernel.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1433312145-19386-1-git-send-email-minchan@kernel.org> References: <1433312145-19386-1-git-send-email-minchan@kernel.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I encountered segfault of test program while I tested MADV_FREE with KSM. By investigation, 1. A KSM page is mapped on page table of A, B processes with !pte_dirty(but it marked the page as PG_dirty if pte_dirty is on) 2. MADV_FREE of A process can remove the page from swap cache if it was in there and then clear *PG_dirty* to indicate we could discard it instead of swapping out. 3. So, the KSM page's status is !pte_dirty of A, B processes && !PageDirty. 4. VM judges it as freeable page and discard it. 5. Process B encounters segfault even though B didn't call MADV_FREE. Clearing PG_dirty after anonymous page is removed from swap cache was no problem on integrity POV for private page(ie, normal anon page, not KSM). Just worst case caused by that was unnecessary write out which we have avoided it if same data is already on swap. However, with introducing MADV_FREE, it could make above problem so this patch fixes it with keeping dirty bit of the page table when the page is replaced with KSM page. Cc: Hugh Dickins Signed-off-by: Minchan Kim --- mm/ksm.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index bc7be0ee2080..9c07346e57f2 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -901,9 +901,8 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page, set_pte_at(mm, addr, ptep, entry); goto out_unlock; } - if (pte_dirty(entry)) - set_page_dirty(page); - entry = pte_mkclean(pte_wrprotect(entry)); + + entry = pte_wrprotect(entry); set_pte_at_notify(mm, addr, ptep, entry); } *orig_pte = *ptep; @@ -932,11 +931,13 @@ static int replace_page(struct vm_area_struct *vma, struct page *page, struct mm_struct *mm = vma->vm_mm; pmd_t *pmd; pte_t *ptep; + pte_t entry; spinlock_t *ptl; unsigned long addr; int err = -EFAULT; unsigned long mmun_start; /* For mmu_notifiers */ unsigned long mmun_end; /* For mmu_notifiers */ + bool dirty; addr = page_address_in_vma(page, vma); if (addr == -EFAULT) @@ -956,12 +957,22 @@ static int replace_page(struct vm_area_struct *vma, struct page *page, goto out_mn; } + dirty = pte_dirty(*ptep); get_page(kpage); page_add_anon_rmap(kpage, vma, addr); flush_cache_page(vma, addr, pte_pfn(*ptep)); ptep_clear_flush_notify(vma, addr, ptep); - set_pte_at_notify(mm, addr, ptep, mk_pte(kpage, vma->vm_page_prot)); + + entry = mk_pte(kpage, vma->vm_page_prot); + /* + * Keep a dirty bit to prevent a KSM page sudden freeing + * by MADV_FREE. + */ + if (dirty) + entry = pte_mkdirty(entry); + + set_pte_at_notify(mm, addr, ptep, entry); page_remove_rmap(page); if (!page_mapped(page)) -- 1.9.1