lkml.org 
[lkml]   [2017]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 4.4 18/58] mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries
From
Date
Ben Hutchings <ben.hutchings@codethink.co.uk> wrote:

> On Sat, 2017-08-12 at 23:27 -0700, Nadav Amit wrote:
>> Ben Hutchings <ben.hutchings@codethink.co.uk> wrote:
>>
>>> On Wed, 2017-08-09 at 12:41 -0700, Greg Kroah-Hartman wrote:
>>>> 4.4-stable review patch. If anyone has any objections, please let me know.
>>>>
>>>> ------------------
>>>>
>>>> From: Mel Gorman <mgorman@suse.de>
>>>>
>>>> commit 3ea277194daaeaa84ce75180ec7c7a2075027a68 upstream.
>>> [...]
>>>> +/*
>>>> + * Reclaim unmaps pages under the PTL but do not flush the TLB prior to
>>>> + * releasing the PTL if TLB flushes are batched. It's possible for a parallel
>>>> + * operation such as mprotect or munmap to race between reclaim unmapping
>>>> + * the page and flushing the page. If this race occurs, it potentially allows
>>>> + * access to data via a stale TLB entry. Tracking all mm's that have TLB
>>>> + * batching in flight would be expensive during reclaim so instead track
>>>> + * whether TLB batching occurred in the past and if so then do a flush here
>>>> + * if required. This will cost one additional flush per reclaim cycle paid
>>>> + * by the first operation at risk such as mprotect and mumap.
>>>> + *
>>>> + * This must be called under the PTL so that an access to tlb_flush_batched
>>>> + * that is potentially a "reclaim vs mprotect/munmap/etc" race will synchronise
>>>> + * via the PTL.
>>>
>>> What about USE_SPLIT_PTE_PTLOCKS? I don't see how you can use "the PTL"
>>> to synchronise access to a per-mm flag.
>>
>> Although it is a per-mm flag, the only situations we care about it are those
>> in which “the PTL” (i.e. the same PTL) is accessed by both the reclaimer
>> (which batches the flushes) and mprotect/munmap/etc.
>
> Is there anything that presents this sequence?
>
> P0 P1 P2
> -- -- --
>
> change_pte_range() [ptl=X]
> -> flush_tlb_batch_pending()
> -> flush_tlb_mm()
> try_to_unmap_one() [ptl=Y]
> -> set_tlb_ubc_flush_pending()
> -> tlb_flush_batched = true
> -> tlb_flush_batched = false
>
> change_pte_range() [ptl=Y]
> ->
> flush_tlb_batch_pending()
> (nop)

I think (but not sure) that you regard a similar concern I raised before.
Mel gave an answer [1], but I cannot say I feel very comfortable with it.

[1] http://www.spinics.net/lists/linux-mm/msg131265.html

Nadav
\
 
 \ /
  Last update: 2017-08-15 18:40    [W:0.212 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site