On 25.8.2015 22:11, Paul E. McKenney wrote:

On Tue, Aug 25, 2015 at 09:33:54PM +0300, Kirill A. Shutemov wrote:

quoted

On Tue, Aug 25, 2015 at 01:44:13PM +0200, Vlastimil Babka wrote:

quoted

On 08/21/2015 02:10 PM, Kirill A. Shutemov wrote:

quoted

On Thu, Aug 20, 2015 at 04:36:43PM -0700, Andrew Morton wrote:

quoted

On Wed, 19 Aug 2015 12:21:45 +0300 "Kirill A. Shutemov" [off-list ref] wrote:

quoted

The patch introduces page->compound_head into third double word block in
front of compound_dtor and compound_order. That means it shares storage
space with:

 - page->lru.next;
 - page->next;
 - page->rcu_head.next;
 - page->pmd_huge_pte;

We should probably ask Paul about the chances that rcu_head.next would like
to use the bit too one day?

+Paul.

The call_rcu() function does stomp that bit, but if you stop using that
bit before you invoke call_rcu(), no problem.

You mean that it sets the bit 0 of rcu_head.next during its processing? That's
bad news then. It's not that we would trigger that bit when the rcu_head part of
the union is "active". It's that pfn scanners could inspect such page at
arbitrary time, see the bit 0 set (due to RCU processing) and think that it's a
tail page of a compound page, and interpret the rest of the pointer as a pointer
to the head page (to test it for flags etc).


--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>