linux-kernel - Re: [PATCH] mm/slub: use unchecked percpu access within preemptible sections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20150122051321.GG21444@js1304-P5Q-DELUXE>
Date:	Thu, 22 Jan 2015 14:13:21 +0900
From:	Joonsoo Kim <iamjoonsoo.kim@....com>
To:	Sasha Levin <sasha.levin@...cle.com>
Cc:	linux-kernel@...r.kernel.org, cl@...ux.com, brouer@...hat.com,
	akpm@...ux-foundation.org
Subject: Re: [PATCH] mm/slub: use unchecked percpu access within preemptible
 sections

On Wed, Jan 21, 2015 at 09:27:41PM -0500, Sasha Levin wrote:
> On 01/21/2015 08:59 PM, Joonsoo Kim wrote:
> > On Tue, Jan 20, 2015 at 11:31:43PM -0500, Sasha Levin wrote:
> >> > Commit "mm/slub: optimize alloc/free fastpath by removing preemption on/off"
> >> > has added access to percpu memory while the code is preemptible.
> >> > 
> >> > While those accesses are okay, this creates a huge amount of warnings from
> >> > the code that checks for that.
> >> > 
> >> > Signed-off-by: Sasha Levin <sasha.levin@...cle.com>
> > Hello,
> > 
> > I already sent the patch to fix this issue and it is in mmotm, but,
> > not be released yet.
> > 
> > https://lkml.org/lkml/2015/1/19/17
> 
> The patch you sent out still has the issue. The one I sent goes on top of
> it.
> 
> +	do {
> +		tid = this_cpu_read(s->cpu_slab->tid); <=== checked percpu access
> +		c = raw_cpu_ptr(s->cpu_slab);
> +	} while (IS_ENABLED(CONFIG_PREEMPT) && unlikely(tid != c->tid));
> 

Hello,

this_cpu_xxx() is designed to be called regardless of interrupts and
preemption.

In Documentation/this_cpu_ops.txt,

The following this_cpu() operations with implied preemption protection
are defined. These operations can be used without worrying about
preemption and interrupts.

        this_cpu_read(pcp)
        ...

And, for correctness of algorithm, tid should be fetched through
this_cpu_read() rather than raw_cpu_read(). Generic implementation of
raw_cpu_read() has a race window to fetch different cpu's tid instead
of the cpu where we are at now and this will cause algorithm broken.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/