On Wed 02-04-14 13:13:34, John Stultz wrote: > On 04/02/2014 12:47 PM, Johannes Weiner wrote: > > On Wed, Apr 02, 2014 at 12:01:00PM -0700, John Stultz wrote: > >> On Wed, Apr 2, 2014 at 10:58 AM, Johannes Weiner <hannes@xxxxxxxxxxx> wrote: > >>> On Wed, Apr 02, 2014 at 10:40:16AM -0700, John Stultz wrote: > >>>> That point beside, I think the other problem with the page-cleaning > >>>> volatility approach is that there are other awkward side effects. For > >>>> example: Say an application marks a range as volatile. One page in the > >>>> range is then purged. The application, due to a bug or otherwise, > >>>> reads the volatile range. This causes the page to be zero-filled in, > >>>> and the application silently uses the corrupted data (which isn't > >>>> great). More problematic though, is that by faulting the page in, > >>>> they've in effect lost the purge state for that page. When the > >>>> application then goes to mark the range as non-volatile, all pages are > >>>> present, so we'd return that no pages were purged. From an > >>>> application perspective this is pretty ugly. > >>>> > >>>> Johannes: Any thoughts on this potential issue with your proposal? Am > >>>> I missing something else? > >>> No, this is accurate. However, I don't really see how this is > >>> different than any other use-after-free bug. If you access malloc > >>> memory after free(), you might receive a SIGSEGV, you might see random > >>> data, you might corrupt somebody else's data. This certainly isn't > >>> nice, but it's not exactly new behavior, is it? > >> The part that troubles me is that I see the purged state as kernel > >> data being corrupted by userland in this case. The kernel will tell > >> userspace that no pages were purged, even though they were. Only > >> because userspace made an errant read of a page, and got garbage data > >> back. > > That sounds overly dramatic to me. First of all, this data still > > reflects accurately the actions of userspace in this situation. And > > secondly, the kernel does not rely on this data to be meaningful from > > a userspace perspective to function correctly. > <insert dramatic-chipmunk video w/ text overlay "errant read corrupted > volatile page purge state!!!!1"> > > Maybe you're right, but I feel this is the sort of thing application > developers would be surprised and annoyed by. > > > > It's really nothing but a use-after-free bug that has consequences for > > no-one but the faulty application. The thing that IS new is that even > > a read is enough to corrupt your data in this case. > > > > MADV_REVIVE could return 0 if all pages in the specified range were > > present, -Esomething if otherwise. That would be semantically sound > > even if userspace messes up. > > So its semantically more of just a combined mincore+dirty operation.. > and nothing more? > > What are other folks thinking about this? Although I don't particularly > like it, I probably could go along with Johannes' approach, forgoing > SIGBUS for zero-fill and adapting the semantics that are in my mind a > bit stranger. This would allow for ashmem-like style behavior w/ the > additional write-clears-volatile-state and read-clears-purged-state > constraints (which I don't think would be problematic for Android, but > am not totally sure). > > But I do worry that these semantics are easier for kernel-mm-developers > to grasp, but are much much harder for application developers to > understand. Yeah, I have to admit that although the simplicity of the implementation looks compelling, the interface from a userspace POV looks weird. Honza -- Jan Kara <jack@xxxxxxx> SUSE Labs, CR -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>