On Sun, Sep 11, 2016 at 11:54:25PM +0100, Lorenzo Stoakes wrote: > The NUMA balancing logic uses an arch-specific PROT_NONE page table flag defined > by pte_protnone() or pmd_protnone() to mark PTEs or huge page PMDs respectively > as requiring balancing upon a subsequent page fault. User-defined PROT_NONE > memory regions which also have this flag set will not normally invoke the NUMA > balancing code as do_page_fault() will send a segfault to the process before > handle_mm_fault() is even called. > > However if access_remote_vm() is invoked to access a PROT_NONE region of memory, > handle_mm_fault() is called via faultin_page() and __get_user_pages() without > any access checks being performed, meaning the NUMA balancing logic is > incorrectly invoked on a non-NUMA memory region. > > A simple means of triggering this problem is to access PROT_NONE mmap'd memory > using /proc/self/mem which reliably results in the NUMA handling functions being > invoked when CONFIG_NUMA_BALANCING is set. > > This issue was reported in bugzilla (issue 99101) which includes some simple > repro code. > > There are BUG_ON() checks in do_numa_page() and do_huge_pmd_numa_page() added at > commit c0e7cad to avoid accidentally provoking strange behaviour by attempting > to apply NUMA balancing to pages that are in fact PROT_NONE. The BUG_ON()'s are > consistently triggered by the repro. > > This patch moves the PROT_NONE check into mm/memory.c rather than invoking > BUG_ON() as faulting in these pages via faultin_page() is a valid reason for > reaching the NUMA check with the PROT_NONE page table flag set and is therefore > not always a bug. > > Link: https://bugzilla.kernel.org/show_bug.cgi?id=99101 > Reported-by: Trevor Saunders <tbsaunde@xxxxxxxxxxxx> > Signed-off-by: Lorenzo Stoakes <lstoakes@xxxxxxxxx> Acked-by: Mel Gorman <mgorman@xxxxxxxxxxxxxxxxxxx> -- Mel Gorman SUSE Labs -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>