linux-kernel - Re: kmemcheck caught read from freed memory (cfq_free_io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <84144f020804021253i7e08e83fve3f2707063fc64d1@mail.gmail.com>
Date:	Wed, 2 Apr 2008 22:53:53 +0300
From:	"Pekka Enberg" <penberg@...helsinki.fi>
To:	paulmck@...ux.vnet.ibm.com
Cc:	"Vegard Nossum" <vegard.nossum@...il.com>,
	"Ingo Molnar" <mingo@...e.hu>,
	"Jens Axboe" <jens.axboe@...cle.com>,
	"Peter Zijlstra" <a.p.zijlstra@...llo.nl>,
	"Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>
Subject: Re: kmemcheck caught read from freed memory (cfq_free_io_context)

Hi Paul,

On Wed, Apr 02, 2008 at 07:32:26PM +0300, Pekka J Enberg wrote:
> > Well, maybe we can add two new states: RCU_FREED and RCU_VALIDATED? The
> > object is flagged with the first one as soon as an object is handed over
> > to kmem_cache_free() and the latter needs to hook to the validation phase
> > of RCU (how is that done btw?). Then kmemcheck could even give a better
> > error message: "RCU-freed object used without validation."
> >
> > And with delayed free for kmemcheck we discussed before, we'd hold on to
> > the objects long enough to actually see these error conditions.

On Wed, Apr 2, 2008 at 9:23 PM, Paul E. McKenney
<paulmck@...ux.vnet.ibm.com> wrote:
>  Well, one approach would be to add an rcu_head to the kmem_cache
>  structure, along with a flag stating that the rcu_head is in use.  I hope
>  that there is a better approach, as this introduces a lock roundtrip
>  into kmemcheck_slab_free().  Is there a better place to put the rcu_head?
>  Perhaps into the per-CPU allocator?  But then we have to track which
>  CPU has which mark pending, and there are only so many bits in a byte,
>  as the SGI guys would be quick to point out

I suppose you haven't actually run kmemcheck on your machine? We're
taking a page fault for _every_ memory access so a lock round-trip in
the SLAB_RCU case is probably not that bad performance-wise :-).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/