linux-kernel - Re: [patch] aio: fix buggy put_ioctx call in aio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 Dec 2006 12:34:52 -0500
From:	jmoyer@...hat.com
To:	"Chen, Kenneth W" <kenneth.w.chen@...el.com>
Cc:	"'Andrew Morton'" <akpm@...l.org>, <linux-aio@...ck.org>,
	"'Trond Myklebust'" <trond.myklebust@....uio.no>,
	"'xb'" <xavier.bru@...l.net>,
	"'Zach Brown'" <zach.brown@...cle.com>,
	<linux-kernel@...r.kernel.org>,
	"Paul E. McKenney" <paulmck@...ibm.com>
Subject: Re: [patch] aio: fix buggy put_ioctx call in aio_complete

==> Regarding RE: [patch] aio: fix buggy put_ioctx call in aio_complete; "Chen, Kenneth W" <kenneth.w.chen@...el.com> adds:

kenneth.w.chen> jmoyer@...hat.com wrote on Thursday, December 21, 2006 8:56
kenneth.w.chen> AM I think I'm going to abandon this whole synchronize
kenneth.w.chen> thing and going to put the wake up call inside ioctx_lock
kenneth.w.chen> spin lock along with the other patch you mentioned above in
kenneth.w.chen> the waiter path.  On top of that, I have another patch
kenneth.w.chen> attempts to perform wake-up only when the waiter can truly
kenneth.w.chen> proceed in aio_read_evt so dribbling I/O completion doesn't
kenneth.w.chen> inefficiently waking up waiter too frequently and only to
kenneth.w.chen> have waiter put back to sleep again. I will dig that up and
kenneth.w.chen> experiment.
>> In the mean time, can't we simply take the context lock in
>> wait_for_all_aios?  Unless I missed something, I think that will address
>> the reference count problem.

kenneth.w.chen> Take ioctx_lock is one part, the other part is to move

kenneth.w.chen> 	spin_unlock_irqrestore(&ctx->ctx_lock, flags);

kenneth.w.chen> in aio_complete all the way down to the end of the
kenneth.w.chen> function, after wakeup and put_ioctx.  But then the ref
kenneth.w.chen> counting on ioctx in aio_complete path is Meaningless,
kenneth.w.chen> which is the thing I'm trying to remove.

OK, right.  But are we simply papering over the real problem?  Earlier in
this thread, you stated:

> flush_workqueue() is not allowed to be called in the softirq context.
> However, aio_complete() called from I/O interrupt can potentially call
> put_ioctx with last ref count on ioctx and trigger a bug warning.  It
> is simply incorrect to perform ioctx freeing from aio_complete.

But how do we end up with the last reference to the ioctx in the aio
completion path?  That's a question I haven't seen answered.

-Jeff
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/