linux-kernel - Re: [PATCH 1/6] mmput: use notifier chain to call subsystem exit handler.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 11 Oct 2015 20:03:29 +0100
From:	David Woodhouse <dwmw2@...radead.org>
To:	Jerome Glisse <j.glisse@...il.com>,
	"joro@...tes.org" <joro@...tes.org>
Cc:	"peterz@...radead.org" <peterz@...radead.org>,
	"SCheung@...dia.com" <SCheung@...dia.com>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	"ldunning@...dia.com" <ldunning@...dia.com>,
	"hpa@...or.com" <hpa@...or.com>,
	"aarcange@...hat.com" <aarcange@...hat.com>,
	"jakumar@...dia.com" <jakumar@...dia.com>,
	"mgorman@...e.de" <mgorman@...e.de>,
	"jweiner@...hat.com" <jweiner@...hat.com>,
	"sgutti@...dia.com" <sgutti@...dia.com>,
	"riel@...hat.com" <riel@...hat.com>,
	"Bridgman, John" <John.Bridgman@....com>,
	"jhubbard@...dia.com" <jhubbard@...dia.com>,
	"mhairgrove@...dia.com" <mhairgrove@...dia.com>,
	"cabuschardt@...dia.com" <cabuschardt@...dia.com>,
	"dpoole@...dia.com" <dpoole@...dia.com>,
	"Cornwall, Jay" <Jay.Cornwall@....com>,
	"Lewycky, Andrew" <Andrew.Lewycky@....com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"iommu@...ts.linux-foundation.org" <iommu@...ts.linux-foundation.org>,
	"arvindg@...dia.com" <arvindg@...dia.com>,
	"Deucher, Alexander" <Alexander.Deucher@....com>,
	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
	"torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 1/6] mmput: use notifier chain to call subsystem exit
 handler.

On Tue, 2014-07-08 at 13:03 -0400, Jerome Glisse wrote:
> 
> Now regarding the device side, if we were to cleanup inside the file release
> callback than we would be broken in front of fork. Imagine the following :
>   - process A open device file and mirror its address space (hmm or kfd)
>     through a device file.
>   - process A forks itself (child is B) while having the device file open.
>   - process A quits
> 
> Now the file release will not be call until child B exit which might infinite.
> Thus we would be leaking memory. As we already pointed out we can not free the
> resources from the mmu_notifier >release callback.

So if your library just registers a pthread_atfork() handler to close
the file descriptor in the child, that problem goes away? Like any
other "if we continue to hold file descriptors open when we should
close them, resources don't get freed" problem?

Perhaps we could even handled that automatically in the kernel, with
something like an O_CLOFORK flag on the file descriptor. Although
that's a little horrid.

You've argued that the amdkfd code is special and not just a device
driver. I'm not going to contradict you there, but now we *are* going
to see device drivers doing this kind of thing. And we definitely
*don't* want to be calling back into device driver code from the
mmu_notifier's .release() function.

I think amdkfd absolutely is *not* a useful precedent for normal device
drivers, and we *don't* want to follow this model in the general case.

As we try to put together a generic API for device access to processes'
address space, I definitely think we want to stick with the model that
we take a reference on the mm, and we *keep* it until the device driver
unbinds from the mm (because its file descriptor is closed, or
whatever).

Perhaps you can keep a back door into the AMD IOMMU code to continue to
do what you're doing, or perhaps the explicit management of off-cpu
tasks that is being posited will give you a sane cleanup path that
*doesn't* involve the IOMMU's mmu_notifier calling back to you. But
either way, I *really* don't want this to be the way it works for
device drivers.

> One hacky way to do it would be to schedule some delayed job from 
> >release callback but then again we would have no way to properly 
> synchronize ourself with other mm destruction code ie the delayed job 
> could run concurently with other mm destruction code and interfer
> badly.

With the RCU-based free of the struct containing the notifier, your
'schedule some delayed job' is basically what we have now, isn't it?

I note that you also have your *own* notifier which does other things,
and has to cope with being called before or after the IOMMU's notifier.

Seriously, we don't want device drivers having to do this. We really
need to keep it simple.

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@...el.com                              Intel Corporation

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5691 bytes)