On Sun, Jan 10, 2021 at 11:26:57PM -0800, John Hubbard wrote: > IMHO, a lot of the bits in page _refcount are still being wasted (even > after GUP_PIN_COUNTING_BIAS overloading), because it's unlikely that > there are many callers of gup/pup per page. If anyone points out that > that is wrong, then the rest of this falls apart, but...if we were to > make a rule that "only a very few FOLL_GET or FOLL_PIN pins are ever > simultaneously allowed on a given page", then several things become > possible: There's "the normal case" and then there's "the attacker case" where someone's deliberately trying to wrap page->_refcount. There are lots of interesting games people can play with an anon page, like stuffing it into (lots of) pipes, forking lots of children, starting lots of O_DIRECT I/O against it to a FUSE filesystem that's deliberately engineered to be slow. We have some protection against that, but I'm not 100% sure it's working, and making it easier to increase refcount in large chunks makes it more likely that we would defeat that protection.
