lkml.org 
[lkml]   [2024]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] mm/mmap: simplify vma_merge()
From

On 2024/1/24 00:08, Liam R. Howlett wrote:
> Adding to the Cc list, because it's vma_merge().
>
> * Yajun Deng <yajun.deng@linux.dev> [240118 03:23]:
>> These vma_merge() callers will pass mm, anon_vma and file, they all from
>> vma. There is no need to pass three parameters at the same time.
>>
>> We will find the current vma in vma_merge().
> It sounds like you are adding a search for current to vma_merger(), but
> you are removing that part in your patch, so it's odd to say this here.
>

Okay.

>> If we pass the original vma
>> to vma_merge(), the current vma is actually the original vma or NULL.
> What do you mean original vma? The source of the anon_vma, vm_mm, etc?
> If so, the 'original' vma could be prev (shifting boundaries in case 4
> and 5 in the comments). I think "vma that was the source of the
> arguments" would be more clear than "original vma".
>

Okay.

>> So we didn't need to find the current vma with find_vma_intersection().
>>
>> Pass vma to vma_merge(), and add a check to make sure the current vma
>> is an existing vma.
> How could it not be an existing vma? It is dereferenced, so it exists.
> Do you mean a vma in the vma tree?
It means the current vma is NULL or not.
> I think this is all to say that we can pass through the vma to figure
> out if curr == NULL, or if it's vma directly.
>
Okay.
>> Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
>> ---
>> mm/mmap.c | 37 +++++++++++++++++--------------------
>> 1 file changed, 17 insertions(+), 20 deletions(-)
>>
>> diff --git a/mm/mmap.c b/mm/mmap.c
>> index 49d25172eac8..7e00ae4f39e3 100644
>> --- a/mm/mmap.c
>> +++ b/mm/mmap.c
>> @@ -860,14 +860,16 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
>> * area is returned, or the function will return NULL
>> */
>> static struct vm_area_struct
>> -*vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
>> - struct vm_area_struct *prev, unsigned long addr, unsigned long end,
>> - unsigned long vm_flags, struct anon_vma *anon_vma, struct file *file,
>> - pgoff_t pgoff, struct mempolicy *policy,
>> +*vma_merge(struct vma_iterator *vmi, struct vm_area_struct *prev,
>> + struct vm_area_struct *curr, unsigned long addr, unsigned long end,
>> + unsigned long vm_flags, pgoff_t pgoff, struct mempolicy *policy,
>> struct vm_userfaultfd_ctx vm_userfaultfd_ctx,
>> struct anon_vma_name *anon_name)
>> {
>> - struct vm_area_struct *curr, *next, *res;
>> + struct mm_struct *mm = curr->vm_mm;
>> + struct anon_vma *anon_vma = curr->anon_vma;
>> + struct file *file = curr->vm_file;
>> + struct vm_area_struct *next = NULL, *res;
>> struct vm_area_struct *vma, *adjust, *remove, *remove2;
>> struct vm_area_struct *anon_dup = NULL;
>> struct vma_prepare vp;
>> @@ -889,13 +891,12 @@ static struct vm_area_struct
>> return NULL;
>>
>> /* Does the input range span an existing VMA? (cases 5 - 8) */
>> - curr = find_vma_intersection(mm, prev ? prev->vm_end : 0, end);
>> + if (prev == curr || addr != curr->vm_start || end > curr->vm_end)
>> + curr = NULL;
> It would be nice to have comments about what cases this logic covers,
> because reverse engineering it is a pain. And we have to do it every
> time a change occurs in the function, even when we are the ones who
> wrote the statement. I think we can all agree that this function is
> painful, but it's improving and thanks for joining.


Okay.

>>
>> if (!curr || /* cases 1 - 4 */
>> end == curr->vm_end) /* cases 6 - 8, adjacent VMA */
>> - next = vma_lookup(mm, end);
>> - else
>> - next = NULL; /* case 5 */
>> + next = vma_lookup(mm, end); /* NULL case 5 */
> Ah, maybe put the comment about case 5 being null on a different line.
> I thought you were saying the vma_lookup() will return NULL, not that it
> was initialised as NULL above. Change the wording to something like
> "case 5 set to NULL above" or "case 5 remains NULL".
>

Okay.

>>
>> if (prev) {
>> vma_start = prev->vm_start;
>> @@ -919,7 +920,6 @@ static struct vm_area_struct
>>
>> /* Verify some invariant that must be enforced by the caller. */
>> VM_WARN_ON(prev && addr <= prev->vm_start);
>> - VM_WARN_ON(curr && (addr != curr->vm_start || end > curr->vm_end));
> Why did you drop this? I understand you moved basically all of it to an
> if statement above, but it's still true, right? Considering the
> trickiness of the function I'd like to keep it if there's no one who
> feels strongly about it.


I don't think we need this. We move this to the front of the function,
addr, end and curr won't be

changed until then.

>> VM_WARN_ON(addr >= end);
>>
> ...
>
> To increase the chances of actually finding an issue, I would suggest
> splitting this into two patches:
>
> 1. Just passing through vma.
> 2. The logic changes to remove that find_vma_intersection() call.
Okay.
> By the way, what are the performance benefits to this change? It's not
> without its own risks - this function has caused subtle bugs that
> persisted for several releases in the past and it'd be nice to know what
> we are gaining for the risk.


No, I just found out that the current vma is the source vma. So we don't
need to find the current

vma with find_vma_intersection().

I think we can add some case about vma_merge() to the LTP project. It
currently has 5 test cases

about vma, but it doesn't seem to detect the risk of vma_merge().

Link: http://linux-test-project.github.io/

>
> Thanks,
> Liam

\
 
 \ /
  Last update: 2024-05-27 14:31    [W:0.034 / U:0.480 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site