linux-kernel - Re: [RFC] Move the memory_notifier out of the memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.02.1402051512490.24489@chino.kir.corp.google.com>
Date:	Wed, 5 Feb 2014 15:20:07 -0800 (PST)
From:	David Rientjes <rientjes@...gle.com>
To:	Nathan Zimmer <nzimmer@....com>
cc:	linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Tang Chen <tangchen@...fujitsu.com>,
	Wen Congyang <wency@...fujitsu.com>,
	Toshi Kani <toshi.kani@...com>,
	Yasuaki Ishimatsu <isimatu.yasuaki@...fujitsu.com>,
	Xishi Qiu <qiuxishi@...wei.com>,
	Cody P Schafer <cody@...ux.vnet.ibm.com>,
	"Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
	Jiang Liu <liuj97@...il.com>, Hedi Berriche <hedi@....com>,
	Mike Travis <travis@....com>
Subject: Re: [RFC] Move the memory_notifier out of the memory_hotplug lock

On Wed, 5 Feb 2014, Nathan Zimmer wrote:

> > That looks a little problematic, what happens if a nid is being brought
> > online and a registered callback does something like allocate resources
> > for the arg->status_change_nid and the above two hunks of this patch end
> > up racing?
> > 
> > Before, a registered callback would be guaranteed to see either a
> > MEMORY_CANCEL_ONLINE or MEMORY_ONLINE after it has already done
> > MEMORY_GOING_ONLINE.
> > 
> > With your patch, we could race and see one cpu doing MEMORY_GOING_ONLINE,
> > another cpu doing MEMORY_GOING_ONLINE, and then MEMORY_ONLINE and
> > MEMORY_CANCEL_ONLINE in either order.
> > 
> > So I think this patch will break most registered callbacks that actually
> > depend on lock_memory_hotplug(), it's a coarse lock for that reason.
> 
> Since the argument being passed in is the pfn and size it would be an issue
> only if two threads attepted to online the same piece of memory. Right?
> 

No, I'm referring to registered callbacks that provide a resource for 
arg->status_change_nid.  An example would be the callbacks I added to the 
slub allocator in slab_memory_callback().  If we are now able to get a 
racy MEM_GOING_ONLINE -> MEM_GOING_ONLINE -> MEM_ONLINE -> 
MEM_CANCEL_ONLINE, which is possible with your patch _and_ the node being 
successfully onlined at the end, then we get a NULL pointer dereference 
because the kmem_cache_node for each slab cache has been freed.

> That seems very unlikely but if it can happen it needs to be protected
> against.
> 

The protection for registered memory online or offline callbacks is 
lock_memory_hotplug() which is eliminated with your patch, the locking for 
memory_notify() that you're citing is irrelevant.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/