linux-kernel - [BUG?] memory hotplug: include/linux/radix-tree.h:145 invoked rcu_dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1291748509.19276.62.camel@thinkpad>
Date:	Tue, 07 Dec 2010 20:01:49 +0100
From:	Gerald Schaefer <gerald.schaefer@...ibm.com>
To:	paulmck@...ux.vnet.ibm.com,
	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
Cc:	Milton Miller <miltonm@....com>,
	Minchan Kim <minchan.kim@...il.com>,
	linux-kernel@...r.kernel.org, linux-mm@...r.kernel.org,
	linux-ext4@...r.kernel.org, "Ted Ts'o" <tytso@....edu>,
	Arun Bhanu <ab@...nbhanu.com>, Mel Gorman <mel@....ul.ie>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Heiko Carstens <heiko.carstens@...ibm.com>,
	Martin Schwidefsky <schwidefsky@...ibm.com>
Subject: [BUG?] memory hotplug: include/linux/radix-tree.h:145 invoked
 rcu_dereference_check() without protection!

I got the same warning as reported by Arun Bhanu in "[BUG?] [Ext4] INFO:
suspicious rcu_dereference_check() usage" during memory hotplug test on
2.6.37-rc5, see below.

migrate_pages() -> unmap_and_move() only calls rcu_read_lock() for anonymous
pages, as introduced by git commit 989f89c57e6361e7d16fbd9572b5da7d313b073d.
This should be ok, as the comment suggests, so the warning is probably a
false positive. Eventually, migrate_page_move_mapping() will call
radix_tree_deref_slot() with tree_lock held, but w/o rcu_read_lock() for
non-anonymous pages.

As suggested by Milton before, a new version of radix_tree_deref_slot that
uses rcu_dereference_protected could help, if this is a false positive, or
maybe the rcu_read_lock() should be called for all pages, not just anonymous.
Any thoughts?


===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
include/linux/radix-tree.h:145 invoked rcu_dereference_check() without protection!

other info that might help us debug this:


rcu_scheduler_active = 1, debug_locks = 0
6 locks held by sh/960:
 #0:  (&buffer->mutex){+.+.+.}, at: [<00000000002afa7a>] sysfs_write_file+0x4a/0x1a8
 #1:  (s_active#52){.+.+.+}, at: [<00000000002afb02>] sysfs_write_file+0xd2/0x1a8
 #2:  (&mem->state_mutex){+.+.+.}, at: [<0000000000404d78>] memory_block_change_state+0x40/0x1a0
 #3:  (mem_hotplug_mutex){+.+.+.}, at: [<00000000002242c4>] lock_memory_hotplug+0x2c/0x44
 #4:  (pm_mutex){+.+.+.}, at: [<000000000022483c>] remove_memory+0x104/0x758
 #5:  (&(&inode->i_data.tree_lock)->rlock){..-...}, at: [<000000000022624a>] migrate_page_move_mapping+0x4a/0x2d8

stack backtrace:
CPU: 2 Not tainted 2.6.37-rc5 #2
Process sh (pid: 960, task: 0000000018e38640, ksp: 000000000f037818)
000000000f037ad8 000000000f037a58 0000000000000002 0000000000000000
       000000000f037af8 000000000f037a70 000000000f037a70 0000000000567c42
       0000000000000000 0000000017bd7e78 0000000000000002 0000000017bd2e30
       000003e00000000d 000003e00000000c 000000000f037ac0 0000000000000000
       0000000000000000 0000000000100bfa 000000000f037a58 000000000f037a98
Call Trace:
([<0000000000100b02>] show_trace+0xee/0x144)
 [<00000000002263ea>] migrate_page_move_mapping+0x1ea/0x2d8
 [<0000000000226b1c>] migrate_page+0x38/0x68
 [<0000000000226c36>] move_to_new_page+0xea/0x2bc
 [<00000000002276f6>] migrate_pages+0x496/0x568
 [<0000000000224be6>] remove_memory+0x4ae/0x758
 [<0000000000404e20>] memory_block_change_state+0xe8/0x1a0
 [<0000000000404fda>] store_mem_state+0x102/0x138
 [<00000000002afb26>] sysfs_write_file+0xf6/0x1a8
 [<000000000023357c>] vfs_write+0xac/0x18c
 [<0000000000233758>] SyS_write+0x58/0xa8
 [<0000000000113976>] sysc_noemu+0x16/0x1c
 [<0000020000162edc>] 0x20000162edc
INFO: lockdep is turned off.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/