From patchwork Thu Nov 30 00:09:58 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 120053 Delivered-To: patch@linaro.org Received: by 10.140.22.227 with SMTP id 90csp22298qgn; Wed, 29 Nov 2017 16:10:04 -0800 (PST) X-Google-Smtp-Source: AGs4zMYSb7XtptDn78Q+YWK1ORpm287BC5XME5D+MuNNE4rscVRmYtI2HJWXrpJRasthm8ixqZVt X-Received: by 10.84.252.143 with SMTP id y15mr656519pll.138.1512000604417; Wed, 29 Nov 2017 16:10:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1512000604; cv=none; d=google.com; s=arc-20160816; b=aeuLRotZEJ2mJ/6awz416DYQcGd37qOZ1+jAuR1Kp+rZm4IifbDCKiWjnUl75gp5VK UwbwXCpojSX/UKQVtVP3Nyu8d60+UhCGzLZW1xKRZ7WTe6mjvpCZA6lYz96QFaz4V/oA Ae5xIO2kje0bd/5mECm/QEux83XA2LdhCTNLcgiZ+a2Ei8SIHDO8DUF6N0Cjca8QmMF7 SdKspsh7QlVtMCD0MnfcFBdNbKdlbpAaknNYNg/HOa1VuymWVgrTOqH3tU2y+AhWzxb6 fk1awN6VKvIL7Rh2VWg9amrOLR1OSiVmeLimdKiAFc/7O7UrGv+C7gpNW8s+nl0MnfBk nZuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:message-id:subject:to:from:date :arc-authentication-results; bh=WXyl+Xvqbqb9rEy32JJ8/jOAI5vf1LcobQXzZI0BPlY=; b=WAzCpguva2Ub0DpX1HI0hxEgb+tYgIaWYNazUMrwmMsxUmB6zvSbxevqzLz27nkqIV OJtL0yf4iaGHd569cg/w/6LCNa+cchYg7Mrh5S2hjliZNn2Q7bZWWNExm/yAfOB2xXCO Ce/gd+STuH3DVJCOagMVvbVY083M6ZMvcbuzyB7kmGL8awKTYvcoygm0SzoaTs6iOCPq o8HxsntWmbIJ3LIGPg7FqqmtX/RqAOAu4JKV8JTGG6rOc3xsxIuz68SViKk4l1iPeehm UJ8di6JhEjVgurGHQ+/Wm6yic0aMpcyjpMflFx4YQEGcBfGRsHS81nZJhpJ+AZZgC/LS 0SnA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n129si2038135pgn.572.2017.11.29.16.10.04; Wed, 29 Nov 2017 16:10:04 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753215AbdK3AKB (ORCPT + 9 others); Wed, 29 Nov 2017 19:10:01 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:60428 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753506AbdK3AKA (ORCPT ); Wed, 29 Nov 2017 19:10:00 -0500 Received: from akpm3.svl.corp.google.com (unknown [104.133.9.92]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 451A3C18; Thu, 30 Nov 2017 00:09:59 +0000 (UTC) Date: Wed, 29 Nov 2017 16:09:58 -0800 From: akpm@linux-foundation.org To: torvalds@linux-foundation.org, mm-commits@vger.kernel.org, akpm@linux-foundation.org, wangnan0@huawei.com, aarcange@redhat.com, guro@fb.com, khlebnikov@yandex-team.ru, liubo95@huawei.com, mhocko@suse.com, minchan@kernel.org, mingo@kernel.org, rientjes@google.com, stable@vger.kernel.org, will.deacon@arm.com Subject: [patch 02/28] mm, oom_reaper: gather each vma to prevent leaking TLB entry Message-ID: <5a1f4c56.p/nAHhT9UFhoNKtH%akpm@linux-foundation.org> User-Agent: Heirloom mailx 12.5 6/20/10 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wang Nan Subject: mm, oom_reaper: gather each vma to prevent leaking TLB entry tlb_gather_mmu(&tlb, mm, 0, -1) means gathering the whole virtual memory space. In this case, tlb->fullmm is true. Some archs like arm64 doesn't flush TLB when tlb->fullmm is true: commit 5a7862e83000 ("arm64: tlbflush: avoid flushing when fullmm == 1"). Which causes leaking of tlb entries. Will clarifies his patch: : Basically, we tag each address space with an ASID (PCID on x86) which : is resident in the TLB. This means we can elide TLB invalidation when : pulling down a full mm because we won't ever assign that ASID to another mm : without doing TLB invalidation elsewhere (which actually just nukes the : whole TLB). : : I think that means that we could potentially not fault on a kernel uaccess, : because we could hit in the TLB. There could be a window between complete_signal() sending IPI to other cores and all threads sharing this mm are really kicked off from cores. In this window, the oom reaper may calls tlb_flush_mmu_tlbonly() to flush TLB then frees pages. However, due to the above problem, the TLB entries are not really flushed on arm64. Other threads are possible to access these pages through TLB entries. Moreover, a copy_to_user() can also write to these pages without generating page fault, causes use-after-free bugs. This patch gathers each vma instead of gathering full vm space. In this case tlb->fullmm is not true. The behavior of oom reaper become similar to munmapping before do_exit, which should be safe for all archs. Link: http://lkml.kernel.org/r/20171107095453.179940-1-wangnan0@huawei.com Fixes: aac453635549 ("mm, oom: introduce oom reaper") Signed-off-by: Wang Nan Acked-by: Michal Hocko Acked-by: David Rientjes Cc: Minchan Kim Cc: Will Deacon Cc: Bob Liu Cc: Ingo Molnar Cc: Roman Gushchin Cc: Konstantin Khlebnikov Cc: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton --- mm/oom_kill.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff -puN mm/oom_kill.c~mm-oom_reaper-gather-each-vma-to-prevent-leaking-tlb-entry mm/oom_kill.c --- a/mm/oom_kill.c~mm-oom_reaper-gather-each-vma-to-prevent-leaking-tlb-entry +++ a/mm/oom_kill.c @@ -550,7 +550,6 @@ static bool __oom_reap_task_mm(struct ta */ set_bit(MMF_UNSTABLE, &mm->flags); - tlb_gather_mmu(&tlb, mm, 0, -1); for (vma = mm->mmap ; vma; vma = vma->vm_next) { if (!can_madv_dontneed_vma(vma)) continue; @@ -565,11 +564,13 @@ static bool __oom_reap_task_mm(struct ta * we do not want to block exit_mmap by keeping mm ref * count elevated without a good reason. */ - if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) + if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) { + tlb_gather_mmu(&tlb, mm, vma->vm_start, vma->vm_end); unmap_page_range(&tlb, vma, vma->vm_start, vma->vm_end, NULL); + tlb_finish_mmu(&tlb, vma->vm_start, vma->vm_end); + } } - tlb_finish_mmu(&tlb, 0, -1); pr_info("oom_reaper: reaped process %d (%s), now anon-rss:%lukB, file-rss:%lukB, shmem-rss:%lukB\n", task_pid_nr(tsk), tsk->comm, K(get_mm_counter(mm, MM_ANONPAGES)),