linux-kernel - Re: [PATCH 3/3] eventfd: add internal reference counting to fix notifier race conditions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.1.10.0906220952090.10952@makko.or.mcafeemobile.com>
Date:	Mon, 22 Jun 2009 10:01:19 -0700 (PDT)
From:	Davide Libenzi <davidel@...ilserver.org>
To:	Gregory Haskins <ghaskins@...ell.com>
cc:	mst@...hat.com, kvm@...r.kernel.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	avi@...hat.com, paulmck@...ux.vnet.ibm.com,
	Ingo Molnar <mingo@...e.hu>,
	Rusty Russell <rusty@...tcorp.com.au>
Subject: Re: [PATCH 3/3] eventfd: add internal reference counting to fix
 notifier race conditions

On Mon, 22 Jun 2009, Gregory Haskins wrote:

> Davide Libenzi wrote:
> > On Sun, 21 Jun 2009, Gregory Haskins wrote:
> >
> >   
> >> This looks great, Davide.  I am fairly certain I can now solve the races
> >> and even implement Michael's DEASSIGN feature with this patch in place. 
> >> I will actually fire it up tomorrow when I am back in the office and
> >> give it a spin, but I do not spy any more races via visual inspection.
> >>
> >> Kind Regards,
> >> -Greg
> >>
> >> PS: I was wrong with my previous statement about requiring an embeddable
> >> object (eventfd_notifier for me, eventfd_pollcb for you).  I think you
> >> can technically solve this issue minimally by merely locking the POLLHUP
> >> and exposing the kref.  However, I think that leads to an more awkward
> >> interface (e.g. we already have eventfd_fget() plus we add a new one
> >> like eventfd_refget(), which might confuse users), so I prefer what you
> >> did here.  Just thought I would throw that out there in case you would
> >> prefer to change even fewer lines.
> >>     
> >
> > I actually ended up exposing the eventfd context anyway, since IMO is a 
> > better option instead of holding references to the eventfd file (that 
> > makes VFS people uneasy).
> >   
> 
> I liked "version - 1"  better ;)
> 
> I think ultimately we still want to hold the fget() for
> eventfd_signal(), as it is the producer side.  Without it, we have no
> way of knowing when the last producer goes away if they happen to be an
> in-kernel user.

No you don't. Holding a file* reference does not give you any assurance 
whatsoever that the last consumer did not go away. The f_count value will 
simply be 1 (just you).
If a producer side want to take proper action when the last consumer 
leaves the building, it needs to register a pollcb hook and handle 
POLLHUP.
Exposing the opaque eventfd context, and basing the eventfd operations on 
that one (instead of the live referenced file*) is a cleaner interface.
Can you please base your IRQfd bits on top of that, so that we can give 
this IRQfd thread a closure?


- Davide


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/