linux-kernel - Re: [PATCH v8 1/5] mm: introduce a common interface for balloon pages mobility

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120821172819.GA12294@t510.redhat.com>
Date:	Tue, 21 Aug 2012 14:28:20 -0300
From:	Rafael Aquini <aquini@...hat.com>
To:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
Cc:	Peter Zijlstra <peterz@...radead.org>, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	virtualization@...ts.linux-foundation.org,
	Rusty Russell <rusty@...tcorp.com.au>,
	"Michael S. Tsirkin" <mst@...hat.com>,
	Rik van Riel <riel@...hat.com>, Mel Gorman <mel@....ul.ie>,
	Andi Kleen <andi@...stfloor.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
	Minchan Kim <minchan@...nel.org>
Subject: Re: [PATCH v8 1/5] mm: introduce a common interface for balloon
 pages mobility

On Tue, Aug 21, 2012 at 09:24:32AM -0700, Paul E. McKenney wrote:
> On Tue, Aug 21, 2012 at 05:20:11PM +0200, Peter Zijlstra wrote:
> > On Tue, 2012-08-21 at 09:47 -0300, Rafael Aquini wrote:
> > > +       mapping = rcu_access_pointer(page->mapping);
> > > +       if (mapping)
> > > +               mapping = mapping->assoc_mapping; 
> > 
> > The comment near rcu_access_pointer() explicitly says:
> > 
> >  * Return the value of the specified RCU-protected pointer, but omit the
> >  * smp_read_barrier_depends() and keep the ACCESS_ONCE().  This is useful
> >  * when the value of this pointer is accessed, but the pointer is not
> >  * dereferenced,
> > 
> > Yet you dereference the pointer... smells like fail to me.
> 
> Indeed!
> 
> This will break DEC Alpha.  In addition, if ->mapping can transition
> from non-NULL to NULL, and if you used rcu_access_pointer() rather
> than rcu_dereference() to avoid lockdep-RCU from yelling at you about
> not either being in an RCU read-side critical section or holding an
> update-side lock, you can see failures as follows:
> 
> 1.	CPU 0 runs the above code, picks up mapping, and finds it non-NULL.
> 
> 2.	CPU 0 is preempted or otherwise delayed.  (Keep in mind that
> 	even disabling interrupts in a guest OS does not prevent the
> 	host hypervisor from preempting!)
> 
> 3.	Some other CPU NULLs page->mapping.  Because CPU 0 isn't doing
> 	anything to prevent it, this other CPU frees the memory.
> 
> 4.	CPU 0 resumes, and then accesses what is now the freelist.
> 	Arbitrarily bad things start happening.
> 
> If you are in a read-side critical section, use rcu_dereference() instead
> of rcu_access_pointer().  If you are holding an update-side lock, use
> rcu_dereference_protected() and say what lock you are holding.  If you
> are doing something else, please say what it is.
> 
> 							Thanx, Paul
>
Paul & Peter,

Thanks for looking into this stuff and providing me such valuable feedback, and
RCU usage crashcourse.

I believe rcu_dereference_protected() is what I want/need here, since this code
is always called for pages which we hold locked (PG_locked bit). So, it brings me
to ask you if the following usage looks sane enough to fix the well pointed issue,
or if it's another misuse of RCU API:

+       mapping = rcu_dereference_protecetd(page->mapping, PageLocked(page));
+       if (mapping)
+               mapping = mapping->assoc_mapping; 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/