linux-kernel - Re: kmemcheck caught read from freed memory (cfq_free_io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080402201551.GL9333@linux.vnet.ibm.com>
Date:	Wed, 2 Apr 2008 13:15:51 -0700
From:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
To:	Pekka Enberg <penberg@...helsinki.fi>
Cc:	Vegard Nossum <vegard.nossum@...il.com>,
	Ingo Molnar <mingo@...e.hu>,
	Jens Axboe <jens.axboe@...cle.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: kmemcheck caught read from freed memory (cfq_free_io_context)

On Wed, Apr 02, 2008 at 10:53:53PM +0300, Pekka Enberg wrote:
> Hi Paul,
> 
> On Wed, Apr 02, 2008 at 07:32:26PM +0300, Pekka J Enberg wrote:
> > > Well, maybe we can add two new states: RCU_FREED and RCU_VALIDATED? The
> > > object is flagged with the first one as soon as an object is handed over
> > > to kmem_cache_free() and the latter needs to hook to the validation phase
> > > of RCU (how is that done btw?). Then kmemcheck could even give a better
> > > error message: "RCU-freed object used without validation."
> > >
> > > And with delayed free for kmemcheck we discussed before, we'd hold on to
> > > the objects long enough to actually see these error conditions.
> 
> On Wed, Apr 2, 2008 at 9:23 PM, Paul E. McKenney
> <paulmck@...ux.vnet.ibm.com> wrote:
> >  Well, one approach would be to add an rcu_head to the kmem_cache
> >  structure, along with a flag stating that the rcu_head is in use.  I hope
> >  that there is a better approach, as this introduces a lock roundtrip
> >  into kmemcheck_slab_free().  Is there a better place to put the rcu_head?
> >  Perhaps into the per-CPU allocator?  But then we have to track which
> >  CPU has which mark pending, and there are only so many bits in a byte,
> >  as the SGI guys would be quick to point out
> 
> I suppose you haven't actually run kmemcheck on your machine? We're
> taking a page fault for _every_ memory access so a lock round-trip in
> the SLAB_RCU case is probably not that bad performance-wise :-).

Coward that I am, no I have not.  ;-)

The thing that worries me even more than the lock is the need to keep
track of the addresses.

Then again, if you are taking a page fault on every access, perhaps not
such a big deal to allocate the memory and link it into a list...
But yikes!!!  ;-)

							Thanx, Paul
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/