linux-kernel - Re: [PATCH 3/8] mm, hugetlb: fix race in region tracking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 27 Jan 2014 13:44:02 -0800
From:	Davidlohr Bueso <davidlohr@...com>
To:	Naoya Horiguchi <n-horiguchi@...jp.nec.com>
Cc:	akpm@...ux-foundation.org, iamjoonsoo.kim@....com, riel@...hat.com,
	mgorman@...e.de, mhocko@...e.cz, aneesh.kumar@...ux.vnet.ibm.com,
	kamezawa.hiroyu@...fujitsu.com, hughd@...gle.com,
	david@...son.dropbear.id.au, js1304@...il.com,
	liwanp@...ux.vnet.ibm.com, dhillf@...il.com, rientjes@...gle.com,
	aswin@...com, scott.norton@...com, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/8] mm, hugetlb: fix race in region tracking

On Mon, 2014-01-27 at 16:02 -0500, Naoya Horiguchi wrote:
> On Sun, Jan 26, 2014 at 07:52:21PM -0800, Davidlohr Bueso wrote:
> > From: Joonsoo Kim <iamjoonsoo.kim@....com>
> > 
> > There is a race condition if we map a same file on different processes.
> > Region tracking is protected by mmap_sem and hugetlb_instantiation_mutex.
> > When we do mmap, we don't grab a hugetlb_instantiation_mutex, but only the,
> > mmap_sem (exclusively). This doesn't prevent other tasks from modifying the
> > region structure, so it can be modified by two processes concurrently.
> > 
> > To solve this, introduce a spinlock to resv_map and make region manipulation
> > function grab it before they do actual work.
> > 
> > Acked-by: David Gibson <david@...son.dropbear.id.au>
> > Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@....com>
> > [Updated changelog]
> > Signed-off-by: Davidlohr Bueso <davidlohr@...com>
> > ---
> ...
> > @@ -203,15 +200,23 @@ static long region_chg(struct resv_map *resv, long f, long t)
> >  	 * Subtle, allocate a new region at the position but make it zero
> >  	 * size such that we can guarantee to record the reservation. */
> >  	if (&rg->link == head || t < rg->from) {
> > -		nrg = kmalloc(sizeof(*nrg), GFP_KERNEL);
> > -		if (!nrg)
> > -			return -ENOMEM;
> > +		if (!nrg) {
> > +			spin_unlock(&resv->lock);
> 
> I think that doing kmalloc() inside the lock is simpler.
> Why do you unlock and retry here?

This is a spinlock, no can do -- we've previously debated this and since
the critical region is quite small, a non blocking lock is better suited
here. We do the retry so we don't race once the new region is allocated
after the lock is dropped.

Thanks,
Davidlohr

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/