linux-kernel - Re: [PATCH] mm: protect against concurrent vma expansion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 3 Dec 2012 15:01:10 -0800
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Michel Lespinasse <walken@...gle.com>
Cc:	linux-mm@...ck.org, Rik van Riel <riel@...hat.com>,
	Hugh Dickins <hughd@...gle.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm: protect against concurrent vma expansion

On Fri, 30 Nov 2012 22:56:27 -0800
Michel Lespinasse <walken@...gle.com> wrote:

> expand_stack() runs with a shared mmap_sem lock. Because of this, there
> could be multiple concurrent stack expansions in the same mm, which may
> cause problems in the vma gap update code.
> 
> I propose to solve this by taking the mm->page_table_lock around such vma
> expansions, in order to avoid the concurrency issue. We only have to worry
> about concurrent expand_stack() calls here, since we hold a shared mmap_sem
> lock and all vma modificaitons other than expand_stack() are done under
> an exclusive mmap_sem lock.
> 
> I previously tried to achieve the same effect by making sure all
> growable vmas in a given mm would share the same anon_vma, which we
> already lock here. However this turned out to be difficult - all of the
> schemes I tried for refcounting the growable anon_vma and clearing
> turned out ugly. So, I'm now proposing only the minimal fix.
> 

I think I don't understand the problem fully.  Let me demonstrate:

a) vma_lock_anon_vma() doesn't take a lock which is specific to
   "this" anon_vma.  It takes anon_vma->root->mutex.  That mutex is
   shared with vma->vm_next, yes?  If so, we have no problem here? 
   (which makes me suspect that the races lies other than where I think
   it lies).

b) I can see why a broader lock is needed in expand_upwards(): it
   plays with a different vma: vma->vm_next.  But expand_downwards()
   doesn't do that - it only alters "this" vma.  So I'd have thought
   that vma_lock_anon_vma("this" vma) would be sufficient.


What are the performance costs of this change?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/