On Tue, Aug 01, 2017 at 05:08:11PM -0700, Nadav Amit wrote: > It turns out that Linux TLB batching mechanism suffers from various races. > Races that are caused due to batching during reclamation were recently > handled by Mel and this patch-set deals with others. The more fundamental > issue is that concurrent updates of the page-tables allow for TLB flushes > to be batched on one core, while another core changes the page-tables. > This other core may assume a PTE change does not require a flush based on > the updated PTE value, while it is unaware that TLB flushes are still > pending. > > This behavior affects KSM (which may result in memory corruption) and > MADV_FREE and MADV_DONTNEED (which may result in incorrect behavior). A > proof-of-concept can easily produce the wrong behavior of MADV_DONTNEED. > Memory corruption in KSM is harder to produce in practice, but was observed > by hacking the kernel and adding a delay before flushing and replacing the > KSM page. > > Finally, there is also one memory barrier missing, which may affect > architectures with weak memory model. > > v5 -> v6: > * Combining with Minchan Kim's patch set, adding ack's (Andrew) > * Minor: missing header, typos (Nadav) > * Renaming arch_generic_tlb_finish_mmu (Mel) Thanks for intergrating/correction, Nadav. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
