| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20100518151129.GG2302@linux.vnet.ibm.com>
Date: Tue, 18 May 2010 08:11:29 -0700
From: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
To: Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
Cc: "Michael S. Tsirkin" <mst@...hat.com>,
Peter Zijlstra <peterz@...radead.org>,
linux-kernel@...r.kernel.org, mingo@...e.hu, laijs@...fujitsu.com,
dipankar@...ibm.com, akpm@...ux-foundation.org,
josh@...htriplett.org, dvhltc@...ibm.com, niv@...ibm.com,
tglx@...utronix.de, rostedt@...dmis.org, Valdis.Kletnieks@...edu,
dhowells@...hat.com, eric.dumazet@...il.com,
Arnd Bergmann <arnd@...ay.de.ibm.com>,
Arnd Bergmann <arnd@...db.de>
Subject: Re: [PATCH RFC tip/core/rcu 23/23] vhost: add __rcu annotations
On Tue, May 18, 2010 at 10:47:26AM -0400, Mathieu Desnoyers wrote:
> * Paul E. McKenney (paulmck@...ux.vnet.ibm.com) wrote:
> > On Mon, May 17, 2010 at 09:35:28PM -0400, Mathieu Desnoyers wrote:
> > > * Paul E. McKenney (paulmck@...ux.vnet.ibm.com) wrote:
> > > > On Mon, May 17, 2010 at 07:40:25PM -0400, Mathieu Desnoyers wrote:
> > > > > * Paul E. McKenney (paulmck@...ux.vnet.ibm.com) wrote:
> > > > > > On Mon, May 17, 2010 at 06:00:25PM -0400, Mathieu Desnoyers wrote:
> >
> > [ . . . ]
> >
> > > > > > But perhaps we should be simply treating this as a use-after-free
> > > > > > problem, so that RCU is not directly involved. Isn't that the standard
> > > > > > use of debugobjects anyway?
> > > > >
> > > > > OK so we could tie "rcu_dereference" do debugobjects, and free would be
> > > > > a standard free. Yes, I think it could be done. It looks a bit like the
> > > > > memory allocation debugging code. If we know that a certain
> > > > > rcu_dereference always access dynamically allocated memory, we could
> > > > > probably add some checks there based on the memory allocator debug
> > > > > objects.
> > > >
> > > > We probably need vhost to add code at the end of the relevant RCU
> > > > read-side critical section checking that the pointers returned by
> > > > any rcu_dereference() calls still point to valid memory. Don't get
> > > > me wrong, your approach could find bugs in which someone forgot to
> > > > remove the RCU-protected structure from a public list, but it could
> > > > not detect failure to wait a grace period between the time of removal
> > > > and the time of freeing.
> > >
> > > Good point too. So something like a new rcu_unreference() (or feel free
> > > to find any better name) ;) that would be compiled out normally, but
> > > would call into debugobjects might do the trick. We would have to add
> > > these annotations to match every rcu_dereference() though, might means a
> > > lot of new lines of code. On the plus side, that looks like a good audit
> > > of RCU read-side use. ;)
> >
> > My first thought is that we have added quite a bit of RCU consistency
> > check code in the past few months, so we should see what bugs they find
> > and what bugs escape. It is all too easy to create consistency check
> > code that is more trouble than it is worth.
>
> Yes, although I expect that this new checking scheme will take some time
> to implement and mainline anyway (implementation effort which I might
> leave to someone else, as I have to focus on tracing at the moment).
>
> > But in the meantime, let's see what would be required to check for
> > failures to insert grace-period delays:
> >
> > o There would need to be something like rcu_unreference(),
> > rcu_no_more_readers() or some such after the grace period.
> > The update side would then become something like the following:
> >
> > oldp = rcu_dereference_protected(gp, &mylock);
> > rcu_assign_pointer(gp, newp);
> > synchronize_rcu();
> > rcu_no_more_readers(oldp);
> > kfree(oldp);
>
> Replacing a kfree with a rcu_free(kfree, oldp) call that would include
> both could lessen the amount of typing:
>
> #define rcu_free(freefct, ptr) \
> do { \
> rcu_no_more_readers(ptr); \
> freefct(ptr); \
> } while (0)
Or we could just rely on the existing debugobjects support that is
already in kfree(). ;-)
> > o There would need to be something to check all of the pointers
> > traversed in the read-side critical sections:
> >
> > rcu_read_lock();
> > ...
> > p1 = rcu_dereference(gp1->field1);
> > ...
> > p2 = rcu_dereference(gp2->field2);
> > ...
> >
> > rcu_validate(p1);
> > rcu_validate(p2);
>
> Hrm, isn't the goal of this "rcu_validate(p1)" just to keep track of
> "p1" liveness ? Or do you plan to add a check there also ? I'm not sure
> I figure out what you are planning to validate here. I was thinking more
> in terms of
>
> rcu_unreference(p1);
> rcu_unreference(p1);
>
> that would be symmetric with the rcu_dereference.
My preference would be for people to just use the existing debugobjects
API, debug_check_no_obj_freed(). That is already in place, no need to
create RCU wrappers for it.
> > rcu_read_unlock();
> >
> > One thing that bothers me about this is that we are forcing the developer
> > to do a lot of extra typing. For example, rcu_no_more_readers() is in
> > a truth-and-beauty sense redundant with kfree() -- why type both? The
> > same could be said about rcu_validate() and rcu_read_unlock(), but nested
> > RCU read-side critical sections make this difficult.
>
> Ideally we'd like to add near-zero burden on developers, but I fear this
> cannot be done easily for read-side C.S.. As for write-side, we have to
> choose between tradeoff of genericity and less typing, e.g., between:
>
> rcu_free(kfree, ptr);
> and
> rcu_kfree(ptr)
>
> for the second, we would have to create a whole family of rcu_*free().
>
> >
> > Or am I misunderstanding what you are suggesting?
>
> I'm only unsure about the "validate" part.
Again, we should just rely on the existing debugobjects function, letting
developers use it as they see fit.
Thanx, Paul
> Thanks,
>
> Mathieu
>
> >
> > Thanx, Paul
>
> --
> Mathieu Desnoyers
> Operating System Efficiency R&D Consultant
> EfficiOS Inc.
> http://www.efficios.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists