linux-kernel - Re: [GIT PULL] futex fixlet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1325264878.30917.11.camel@twins>
Date:	Fri, 30 Dec 2011 18:07:58 +0100
From:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Ingo Molnar <mingo@...e.hu>, linux-kernel@...r.kernel.org,
	Thomas Gleixner <tglx@...utronix.de>,
	Darren Hart <dvhltc@...ibm.com>,
	Hugh Dickins <hughd@...gle.com>
Subject: Re: [GIT PULL] futex fixlet

On Thu, 2011-12-29 at 17:26 -0800, Linus Torvalds wrote:
> Why do we even bother to check "page->mapping" at all? What's the
> *use* of that loop? My gut feeling is that *that* is the fundamental
> problem, and we should just get rid of it, rather than add all these
> totally random work-arounds for the problem.
> 
> Peter Z? That "if (!page->mapping) goto again" actually goes back to
> 38d47c1b7075, in 2008. Why does it exist in the first place? There's
> no comment nor explanation in the changelog.
> 
> Why don't we just unconditionally return -EFAULT? What is the retry
> actually supposed to *do*? If somebody races with a mmap/munmap, why
> the hell would we care? What is it doing? 

Vague memory seems to suggest it was to do with an unmap race, now the
only such race we care about is swapping, if someone has a futex and
does munmap+mmap under us we really don't care and you get to keep
whatever result that yields.

That said, the ->mapping test is wrong because ->mapping is not actually
cleared when the page is unmapped.

Also, I suspect the is_page_cache_freeable() test in pageout() avoids
the worst of it. It keeps the page around if we have a reference to it,
so a minor fault will then quickly re-instate the same page without loss
of data.

So I _think_ you're completely right and we can simply kill the whole
thing, but I've been trying very hard to forget everything kernel
related for a week, and I really shouldn't kick-start my brain until
somewhere next week.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/