Messages in this thread | | | Date | Thu, 3 Aug 2017 08:26:24 +0900 | From | Minchan Kim <> | Subject | Re: [PATCH v6 0/7] fixes of TLB batching races |
| |
On Tue, Aug 01, 2017 at 05:08:11PM -0700, Nadav Amit wrote: > It turns out that Linux TLB batching mechanism suffers from various races. > Races that are caused due to batching during reclamation were recently > handled by Mel and this patch-set deals with others. The more fundamental > issue is that concurrent updates of the page-tables allow for TLB flushes > to be batched on one core, while another core changes the page-tables. > This other core may assume a PTE change does not require a flush based on > the updated PTE value, while it is unaware that TLB flushes are still > pending. > > This behavior affects KSM (which may result in memory corruption) and > MADV_FREE and MADV_DONTNEED (which may result in incorrect behavior). A > proof-of-concept can easily produce the wrong behavior of MADV_DONTNEED. > Memory corruption in KSM is harder to produce in practice, but was observed > by hacking the kernel and adding a delay before flushing and replacing the > KSM page. > > Finally, there is also one memory barrier missing, which may affect > architectures with weak memory model. > > v5 -> v6: > * Combining with Minchan Kim's patch set, adding ack's (Andrew) > * Minor: missing header, typos (Nadav) > * Renaming arch_generic_tlb_finish_mmu (Mel)
Thanks for intergrating/correction, Nadav.
| |