linux-kernel - Re: [PATCH] rcu: Improve detection of illegal synchronize

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 5 Jan 2012 02:45:20 +0100
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
Cc:	Sasha Levin <levinsasha928@...il.com>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] rcu: Improve detection of illegal synchronize_rcu() call
 from RCU read side

On Wed, Jan 04, 2012 at 01:30:35PM -0800, Paul E. McKenney wrote:
> On Wed, Jan 04, 2012 at 08:03:39PM +0100, Frederic Weisbecker wrote:
> > Actually for the case of RCU, the wait_for_completion() called by synchronize_rcu()
> > has a might_sleep() call that triggers a warning in this case.
> > 
> > But in the case of SMP with 1 online CPU, the rcu_blocking_is_gp()
> > checks returns right away on rcutree. So probably we need this?
> 
> I modified this to push the might_sleep() down into the
> rcu_blocking_is_gp() function, queued the result, and retained your
> Signed-off-by.  (Please let me know if there is any problem with this.)
> 
> This does work for TREE_PREEMPT_RCU and for synchronize_rcu_bh() in
> TREE_RCU, but not for synchronize_sched() in TREE_RCU.  This is because
> rcu_read_lock() and rcu_read_unlock() are no-ops in the TREE_RCU case.

Not sure about that. This calls preempt_disable() which, in any case with
CONFIG_DEBUG_ATOMIC_SLEEP, handles the preempt count. And that even if
!CONFIG_PREEMPT.

> 
> So I queued up a separate patch using rcu_lockdep_assert() to check for
> illegal RCU grace period within the same-type RCU read-side critical
> section, including for SRCU.  This is also a partial solution, as it
> does not handle things like this:
> 
> 	void foo(void)
> 	{
> 		mutex_lock(&my_mutex);
> 		. . .
> 		synchronize_srcu(&my_srcu);
> 		. . .
> 		mutex_unlock(&my_mutex);
> 	}
> 
> 	void bar(void)
> 	{
> 		int idx;
> 
> 		idx = rcu_read_lock(&m_srcu);
> 		. . .
> 		mutex_lock(&my_mutex);
> 		. . .
> 		mutex_unlock(&my_mutex);
> 		. . .
> 		srcu_read_unlock(&m_srcu, idx);
> 	}
> 
> This can be extended into a chain of locks and a chain of SRCU instances.
> For an example of the latter, consider an SRCU-A read-side critical
> section containing an SRCU-B grace period, an SRCU-B read-side critical
> section containing an SRCU-C grace period, and so on, with the SRCU-Z
> read-side critical section containing an RCU-A grace period.

Heh! Indeed...

> But it
> is OK to hold a mutex across one SRCU read-side critical section while
> acquiring that same mutex within another same-flavor SRCU read-side
> critical section.  So the analogy with reader-writer locking only goes
> so far.
> 
> At the moment, a full solution seems to require some surgery on lockdep
> itself, but perhaps there is a better way.

Ok.

> 
> > rcutiny seems to be fine with the cond_resched() call, but srcu needs
> > a special treatment.
> 
> For the moment, I just applied rcu_lockdep_assert() everywhere -- zero
> cost on non-lockdep kernels, and fully handles all of the RCU simple
> self-deadlock cases.

So, for RCU I'm not sure this is useful given the might_sleep() things.
But for srcu it is.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/