linux-kernel - Re: [PATCH 04/15] mm/hmm: unregister mmu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Mar 2018 14:12:36 -0400
From:   Jerome Glisse <jglisse@...hat.com>
To:     John Hubbard <jhubbard@...dia.com>
Cc:     linux-mm@...ck.org, Andrew Morton <akpm@...ux-foundation.org>,
        linux-kernel@...r.kernel.org,
        Evgeny Baskakov <ebaskakov@...dia.com>,
        Ralph Campbell <rcampbell@...dia.com>,
        Mark Hairgrove <mhairgrove@...dia.com>
Subject: Re: [PATCH 04/15] mm/hmm: unregister mmu_notifier when last HMM
 client quit

On Tue, Mar 20, 2018 at 09:24:41PM -0700, John Hubbard wrote:
> On 03/19/2018 07:00 PM, jglisse@...hat.com wrote:
> > From: Jérôme Glisse <jglisse@...hat.com>
> > 
> > This code was lost in translation at one point. This properly call
> > mmu_notifier_unregister_no_release() once last user is gone. This
> > fix the zombie mm_struct as without this patch we do not drop the
> > refcount we have on it.
> > 
> > Signed-off-by: Jérôme Glisse <jglisse@...hat.com>
> > Cc: Evgeny Baskakov <ebaskakov@...dia.com>
> > Cc: Ralph Campbell <rcampbell@...dia.com>
> > Cc: Mark Hairgrove <mhairgrove@...dia.com>
> > Cc: John Hubbard <jhubbard@...dia.com>
> > ---
> >  mm/hmm.c | 19 +++++++++++++++++++
> >  1 file changed, 19 insertions(+)
> > 
> > diff --git a/mm/hmm.c b/mm/hmm.c
> > index 6088fa6ed137..667944630dc9 100644
> > --- a/mm/hmm.c
> > +++ b/mm/hmm.c
> > @@ -244,10 +244,29 @@ EXPORT_SYMBOL(hmm_mirror_register);
> >  void hmm_mirror_unregister(struct hmm_mirror *mirror)
> >  {
> >  	struct hmm *hmm = mirror->hmm;
> > +	struct mm_struct *mm = NULL;
> > +	bool unregister = false;
> >  
> >  	down_write(&hmm->mirrors_sem);
> >  	list_del_init(&mirror->list);
> > +	unregister = list_empty(&hmm->mirrors);
> 
> Hi Jerome,
> 
> This first minor point may be irrelevant, depending on how you fix 
> the other problem below, but: tiny naming idea: rename unregister 
> to either "should_unregister", or "mirror_snapshot_empty"...the 
> latter helps show that this is stale information, once the lock is 
> dropped. 

First name make sense, second doesn't (at least to me), mirror is dead
at this point, it does not have any implication respective to snapshot
(the mm might still be very well alive and in active use).


> >  	up_write(&hmm->mirrors_sem);
> > +
> > +	if (!unregister)
> > +		return;
> 
> Whee, here I am, lock-free, in the middle of a race condition
> window. :)  Right here, someone (hmm_mirror_register) could be adding
> another mirror.
> 
> It's not immediately clear to me what the best solution is.
> I'd be happier if we didn't have to drop one lock and take
> another like this, but if we do, then maybe rechecking that
> the list hasn't changed...safely, somehow, is a way forward here.
> 

First i want to stress this is very unlikely race, it can only happens
if one hmm_mirror unregister and is last one while another new one try
to register. Highly unlikely but i am sending a v2 which fix that any-
way better safe than sorry. It makes the register side a bit ugly.

Cheers,
Jérôme