From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 648A2C4332F for ; Wed, 6 Apr 2022 21:24:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235639AbiDFVZ6 (ORCPT ); Wed, 6 Apr 2022 17:25:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235660AbiDFVZn (ORCPT ); Wed, 6 Apr 2022 17:25:43 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 02558BA6 for ; Wed, 6 Apr 2022 13:21:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1649276479; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=fRJ4rMy5k3CvTqS0oZ8+MVHunj8v/ly+L+CgzAOxdE4=; b=HLr7ZuQaQjhqukyZOy4f/WD5RSeyMGlpVAOcqZ8pypkgRhr/GzdvQAoRNpItplUS71xFZM jlixTy1zwvSYlfbLaBxc7a0PYKXtElWKi8CwWuHdsU4snYxAyqHaYAH1/IrwPz/5YQONA8 T48GHzGHxrYy4Mf6hV1/8VCWyByCeos= Received: from mail-io1-f72.google.com (mail-io1-f72.google.com [209.85.166.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-646-dBeEFdkbNmyfsqeKZyvbVA-1; Wed, 06 Apr 2022 16:21:17 -0400 X-MC-Unique: dBeEFdkbNmyfsqeKZyvbVA-1 Received: by mail-io1-f72.google.com with SMTP id z23-20020a6b0a17000000b00649f13ea3a7so2287951ioi.23 for ; Wed, 06 Apr 2022 13:21:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=fRJ4rMy5k3CvTqS0oZ8+MVHunj8v/ly+L+CgzAOxdE4=; b=JHUw6sXqOjxiziKPJ+71Skc7nfA31Nf7tJ/PBgB6kZ3Gg0iwsmad6uz++VeFqD/BBJ jkjNI6V8aPoKs4559Br98wpQJlOw1ETqEER9NbZgWAu82H4qJS6z1ZaKpz4ZVQHqVKVD PYFqKyga0yT6lflfe80Y48UAy8ZcweNcpJTHvzNNnVIH5wfi5/Fak1a4QCcdbX8HoApI RKM8HOLwi+YPlmh59TrIuFa9fUKJzgWs+cmZKci6CXOqHwkt/T2PNQCY+yf5iNEbeOia TYWNaS1p+XgHfq/9tEbW/fL6gIlJt5XHmJFAtqo0N/8BMrUopZmhCjX9vEzQmGglQkhp +H8Q== X-Gm-Message-State: AOAM532i9kClRuJkgF1GL3gzhnxpmNpI37hxpiDziEce9yhs30irt24t Lwtq5o5ITRWoQbF2Xg7QFpnNPcHjqPG1/ulIZ5rLaQQ2yI3Vb/9GKwjLSrqE0cc+kLN42knRiRP EYNe5wOBDXyZlF/rw X-Received: by 2002:a05:6602:2a45:b0:648:b21c:6f49 with SMTP id k5-20020a0566022a4500b00648b21c6f49mr4987817iov.206.1649276477186; Wed, 06 Apr 2022 13:21:17 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzdnBAkwcxEZHzD7Fd4ICbr+i8cdPKq3m6MTsSy0uEHqDxEBLxc9ORplLLk0n4RcFJUvPKcsQ== X-Received: by 2002:a05:6602:2a45:b0:648:b21c:6f49 with SMTP id k5-20020a0566022a4500b00648b21c6f49mr4987807iov.206.1649276476931; Wed, 06 Apr 2022 13:21:16 -0700 (PDT) Received: from xz-m1.local (cpec09435e3e0ee-cmc09435e3e0ec.cpe.net.cable.rogers.com. [99.241.198.116]) by smtp.gmail.com with ESMTPSA id u15-20020a92d1cf000000b002ca56804ec4sm3897964ilg.23.2022.04.06.13.21.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 06 Apr 2022 13:21:16 -0700 (PDT) Date: Wed, 6 Apr 2022 16:21:14 -0400 From: Peter Xu To: gregkh@linuxfoundation.org Cc: aarcange@redhat.com, akpm@linux-foundation.org, apopple@nvidia.com, david@redhat.com, hughd@google.com, jhubbard@nvidia.com, kirill@shutemov.name, shy828301@gmail.com, stable@vger.kernel.org, torvalds@linux-foundation.org, vbabka@suse.cz, willy@infradead.org Subject: Re: FAILED: patch "[PATCH] mm: don't skip swap entry even if zap_details specified" failed to apply to 4.14-stable tree Message-ID: References: <1648817515199205@kroah.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="kFzuvrLR6rl8ccuM" Content-Disposition: inline In-Reply-To: <1648817515199205@kroah.com> Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org --kFzuvrLR6rl8ccuM Content-Type: text/plain; charset=utf-8 Content-Disposition: inline --kFzuvrLR6rl8ccuM Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment; filename="patch-4.14.y" >From 4bee8277eb6135aeb5b910a73c42446bde20e123 Mon Sep 17 00:00:00 2001 From: Peter Xu Date: Tue, 22 Mar 2022 14:42:15 -0700 Subject: [PATCH] mm: don't skip swap entry even if zap_details specified NOTE: this is cherry-picked from 5abfd71d936a8aefd9f9ccd299dea7a164a5d455 but backported explicitly to stable branch. A few notes: - zap_mapping used to be called check_mapping. - The patch is simplified too, e.g. we don't add hwpoison or WARN_ON_ONCE() but only start to look after all the swap entries. - There was no zap_skip_check_mapping() yet in the branch, so it's written in the full form to check against zap_details.check_mapping. Original commit message below. ============================= Patch series "mm: Rework zap ptes on swap entries", v5. Patch 1 should fix a long standing bug for zap_pte_range() on zap_details usage. The risk is we could have some swap entries skipped while we should have zapped them. Migration entries are not the major concern because file backed memory always zap in the pattern that "first time without page lock, then re-zap with page lock" hence the 2nd zap will always make sure all migration entries are already recovered. However there can be issues with real swap entries got skipped errornoously. There's a reproducer provided in commit message of patch 1 for that. Patch 2-4 are cleanups that are based on patch 1. After the whole patchset applied, we should have a very clean view of zap_pte_range(). Only patch 1 needs to be backported to stable if necessary. This patch (of 4): The "details" pointer shouldn't be the token to decide whether we should skip swap entries. For example, when the callers specified details->zap_mapping==NULL, it means the user wants to zap all the pages (including COWed pages), then we need to look into swap entries because there can be private COWed pages that was swapped out. Skipping some swap entries when details is non-NULL may lead to wrongly leaving some of the swap entries while we should have zapped them. A reproducer of the problem: ===8<=== #define _GNU_SOURCE /* See feature_test_macros(7) */ #include #include #include #include #include int page_size; int shmem_fd; char *buffer; void main(void) { int ret; char val; page_size = getpagesize(); shmem_fd = memfd_create("test", 0); assert(shmem_fd >= 0); ret = ftruncate(shmem_fd, page_size * 2); assert(ret == 0); buffer = mmap(NULL, page_size * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE, shmem_fd, 0); assert(buffer != MAP_FAILED); /* Write private page, swap it out */ buffer[page_size] = 1; madvise(buffer, page_size * 2, MADV_PAGEOUT); /* This should drop private buffer[page_size] already */ ret = ftruncate(shmem_fd, page_size); assert(ret == 0); /* Recover the size */ ret = ftruncate(shmem_fd, page_size * 2); assert(ret == 0); /* Re-read the data, it should be all zero */ val = buffer[page_size]; if (val == 0) printf("Good\n"); else printf("BUG\n"); } ===8<=== We don't need to touch up the pmd path, because pmd never had a issue with swap entries. For example, shmem pmd migration will always be split into pte level, and same to swapping on anonymous. Add another helper should_zap_cows() so that we can also check whether we should zap private mappings when there's no page pointer specified. This patch drops that trick, so we handle swap ptes coherently. Meanwhile we should do the same check upon migration entry, hwpoison entry and genuine swap entries too. To be explicit, we should still remember to keep the private entries if even_cows==false, and always zap them when even_cows==true. The issue seems to exist starting from the initial commit of git. [peterx@redhat.com: comment tweaks] Link: https://lkml.kernel.org/r/20220217060746.71256-2-peterx@redhat.com Link: https://lkml.kernel.org/r/20220217060746.71256-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20220216094810.60572-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20220216094810.60572-2-peterx@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Peter Xu Reviewed-by: John Hubbard Cc: David Hildenbrand Cc: Hugh Dickins Cc: Alistair Popple Cc: Andrea Arcangeli Cc: "Kirill A . Shutemov" Cc: Matthew Wilcox Cc: Vlastimil Babka Cc: Yang Shi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds (cherry picked from commit 5abfd71d936a8aefd9f9ccd299dea7a164a5d455) Signed-off-by: Peter Xu --- mm/memory.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index b001670c9615..cec495ecffae 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1306,6 +1306,17 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, return ret; } +/* Whether we should zap all COWed (private) pages too */ +static inline bool should_zap_cows(struct zap_details *details) +{ + /* By default, zap all pages */ + if (!details) + return true; + + /* Or, we zap COWed pages only if the caller wants to */ + return !details->check_mapping; +} + static unsigned long zap_pte_range(struct mmu_gather *tlb, struct vm_area_struct *vma, pmd_t *pmd, unsigned long addr, unsigned long end, @@ -1394,17 +1405,19 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb, continue; } - /* If details->check_mapping, we leave swap entries. */ - if (unlikely(details)) - continue; - entry = pte_to_swp_entry(ptent); - if (!non_swap_entry(entry)) + if (!non_swap_entry(entry)) { + /* Genuine swap entry, hence a private anon page */ + if (!should_zap_cows(details)) + continue; rss[MM_SWAPENTS]--; - else if (is_migration_entry(entry)) { + } else if (is_migration_entry(entry)) { struct page *page; page = migration_entry_to_page(entry); + if (details && details->check_mapping && + details->check_mapping != page_rmapping(page)) + continue; rss[mm_counter(page)]--; } if (unlikely(!free_swap_and_cache(entry))) -- 2.32.0 --kFzuvrLR6rl8ccuM--