Re: [PATCH 2/2] mm,migration: Prevent rmap_walk_[anon|ksm] seeing the wrong VMA information

[Minchan Kim]

On Tue, Apr 27, 2010 at 7:37 AM, Mel Gorman <mel@xxxxxxxxx> wrote:
> vma_adjust() is updating anon VMA information without any locks taken.
> In contrast, file-backed mappings use the i_mmap_lock and this lack of
> locking can result in races with page migration. During rmap_walk(),
> vma_address() can return -EFAULT for an address that will soon be valid.
> This leaves a dangling migration PTE behind which can later cause a BUG_ON
> to trigger when the page is faulted in.
>
> With the recent anon_vma changes, there can be more than one anon_vma->lock
> that can be taken in a anon_vma_chain but a second lock cannot be spinned
> upon in case of deadlock. Instead, the rmap walker tries to take locks of
> different anon_vma's. If the attempt fails, the operation is restarted.
>
> Signed-off-by: Mel Gorman <mel@xxxxxxxxx>
> ---
> Âmm/ksm.c Â| Â 13 +++++++++++++
> Âmm/mmap.c | Â Â6 ++++++
> Âmm/rmap.c | Â 22 +++++++++++++++++++---
> Â3 files changed, 38 insertions(+), 3 deletions(-)
>
> diff --git a/mm/ksm.c b/mm/ksm.c
> index 3666d43..baa5b4d 100644
> --- a/mm/ksm.c
> +++ b/mm/ksm.c
> @@ -1674,9 +1674,22 @@ again:
> Â Â Â Â Â Â Â Âspin_lock(&anon_vma->lock);
> Â Â Â Â Â Â Â Âlist_for_each_entry(vmac, &anon_vma->head, same_anon_vma) {
> Â Â Â Â Â Â Â Â Â Â Â Âvma = vmac->vma;
> +
> + Â Â Â Â Â Â Â Â Â Â Â /* See comment in mm/rmap.c#rmap_walk_anon on locking */
> + Â Â Â Â Â Â Â Â Â Â Â if (anon_vma != vma->anon_vma) {
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â if (!spin_trylock(&vma->anon_vma->lock)) {
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â spin_unlock(&anon_vma->lock);
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â goto again;
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â }
> + Â Â Â Â Â Â Â Â Â Â Â }
> +
> Â Â Â Â Â Â Â Â Â Â Â Âif (rmap_item->address < vma->vm_start ||
> Â Â Â Â Â Â Â Â Â Â Â Â Â Ârmap_item->address >= vma->vm_end)
> Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Âcontinue;
> +
> + Â Â Â Â Â Â Â Â Â Â Â if (anon_vma != vma->anon_vma)
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â spin_unlock(&vma->anon_vma->lock);
> +
> Â Â Â Â Â Â Â Â Â Â Â Â/*
> Â Â Â Â Â Â Â Â Â Â Â Â * Initially we examine only the vma which covers this
> Â Â Â Â Â Â Â Â Â Â Â Â * rmap_item; but later, if there is still work to do,
> diff --git a/mm/mmap.c b/mm/mmap.c
> index f90ea92..61d6f1d 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -578,6 +578,9 @@ again: Â Â Â Â Â Â Â Â Â Â Âremove_next = 1 + (end > next->vm_end);
> Â Â Â Â Â Â Â Â}
> Â Â Â Â}
>
> + Â Â Â if (vma->anon_vma)
> + Â Â Â Â Â Â Â spin_lock(&vma->anon_vma->lock);
> +
> Â Â Â Âif (root) {
> Â Â Â Â Â Â Â Âflush_dcache_mmap_lock(mapping);
> Â Â Â Â Â Â Â Âvma_prio_tree_remove(vma, root);
> @@ -620,6 +623,9 @@ again: Â Â Â Â Â Â Â Â Â Â Âremove_next = 1 + (end > next->vm_end);
> Â Â Â Âif (mapping)
> Â Â Â Â Â Â Â Âspin_unlock(&mapping->i_mmap_lock);
>
> + Â Â Â if (vma->anon_vma)
> + Â Â Â Â Â Â Â spin_unlock(&vma->anon_vma->lock);
> +
> Â Â Â Âif (remove_next) {
> Â Â Â Â Â Â Â Âif (file) {
> Â Â Â Â Â Â Â Â Â Â Â Âfput(file);
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 85f203e..bc313a6 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -1368,15 +1368,31 @@ static int rmap_walk_anon(struct page *page, int (*rmap_one)(struct page *,
> Â Â Â Â * are holding mmap_sem. Users without mmap_sem are required to
> Â Â Â Â * take a reference count to prevent the anon_vma disappearing
> Â Â Â Â */
> +retry:
> Â Â Â Âanon_vma = page_anon_vma(page);
> Â Â Â Âif (!anon_vma)
> Â Â Â Â Â Â Â Âreturn ret;
> Â Â Â Âspin_lock(&anon_vma->lock);
> Â Â Â Âlist_for_each_entry(avc, &anon_vma->head, same_anon_vma) {
> Â Â Â Â Â Â Â Âstruct vm_area_struct *vma = avc->vma;
> - Â Â Â Â Â Â Â unsigned long address = vma_address(page, vma);
> - Â Â Â Â Â Â Â if (address == -EFAULT)
> - Â Â Â Â Â Â Â Â Â Â Â continue;
> + Â Â Â Â Â Â Â unsigned long address;
> +
> + Â Â Â Â Â Â Â /*
> + Â Â Â Â Â Â Â Â* Guard against deadlocks by not spinning against
> + Â Â Â Â Â Â Â Â* vma->anon_vma->lock. If contention is found, release our
> + Â Â Â Â Â Â Â Â* lock and try again until VMA list can be traversed without
> + Â Â Â Â Â Â Â Â* contention.
> + Â Â Â Â Â Â Â Â*/
> + Â Â Â Â Â Â Â if (anon_vma != vma->anon_vma) {
> + Â Â Â Â Â Â Â Â Â Â Â if (!spin_trylock(&vma->anon_vma->lock)) {
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â spin_unlock(&anon_vma->lock);
> + Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â goto retry;
> + Â Â Â Â Â Â Â Â Â Â Â }
> + Â Â Â Â Â Â Â }
> + Â Â Â Â Â Â Â address = vma_address(page, vma);
> + Â Â Â Â Â Â Â if (anon_vma != vma->anon_vma)
> + Â Â Â Â Â Â Â Â Â Â Â spin_unlock(&vma->anon_vma->lock);
> +

if (address == -EFAULT)
        continue;

> Â Â Â Â Â Â Â Âret = rmap_one(page, vma, address, arg);
> Â Â Â Â Â Â Â Âif (ret != SWAP_AGAIN)
> Â Â Â Â Â Â Â Â Â Â Â Âbreak;
> --
> 1.6.5
>
>



-- 
Kind regards,
Minchan Kim
èº{.nÇ+‰·Ÿ®‰­†+%ŠËlzwm…ébëæìr¸›zX§»®w¥Š{ayºÊÚë,j­¢f£¢·hš‹àz¹®w¥¢¸¢·¦j:+v‰¨ŠwèjØm¶Ÿÿ¾«‘êçzZ+ƒùšŽŠÝj"ú!¶iO•æ¬z·švØ^¶m§ÿðÃnÆàþY&—