lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAC=cRTOjybaa+nEBcagDebGWh9Ty49TkcJkWi+BcqVcu3at2vA@mail.gmail.com> Date: Fri, 6 Apr 2018 09:57:37 +0800 From: huang ying <huang.ying.caritas@...il.com> To: Zi Yan <zi.yan@...rutgers.edu> Cc: "Huang, Ying" <ying.huang@...el.com>, Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org, LKML <linux-kernel@...r.kernel.org>, Al Viro <viro@...iv.linux.org.uk>, "Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>, Dan Williams <dan.j.williams@...el.com>, "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com> Subject: Re: [PATCH -mm] mm, gup: prevent pmd checking race in follow_pmd_mask() On Wed, Apr 4, 2018 at 11:02 PM, Zi Yan <zi.yan@...rutgers.edu> wrote: > On 3 Apr 2018, at 23:22, Huang, Ying wrote: > >> From: Huang Ying <ying.huang@...el.com> >> >> mmap_sem will be read locked when calling follow_pmd_mask(). But this >> cannot prevent PMD from being changed for all cases when PTL is >> unlocked, for example, from pmd_trans_huge() to pmd_none() via >> MADV_DONTNEED. So it is possible for the pmd_present() check in >> follow_pmd_mask() encounter a none PMD. This may cause incorrect >> VM_BUG_ON() or infinite loop. Fixed this via reading PMD entry again >> but only once and checking the local variable and pmd_none() in the >> retry loop. >> >> As Kirill pointed out, with PTL unlocked, the *pmd may be changed >> under us, so read it directly again and again may incur weird bugs. >> So although using *pmd directly other than pmd_present() checking may >> be safe, it is still better to replace them to read *pmd once and >> check the local variable for multiple times. > > I see you point there. The patch wants to provide a consistent value > for all race checks. Specifically, this patch is trying to avoid the inconsistent > reads of *pmd for if-statements, which causes problem when both if-condition reads *pmd and > the statements inside "if" reads *pmd again and two reads can give different values. > Am I right about this? Yes. > If yes, the problem can be solved by something like: > > if (!pmd_present(tmpval = *pmd)) { > check tmpval instead of *pmd; > } > > Right? I think this isn't enough yet. we need tmpval = READ_ONCE(*pmd); To prevent compiler to generate code to read *pmd again and again. Please check the comments of pmd_none_or_trans_huge_or_clear_bad() about barrier. Best Regards, Huang, Ying > I just wonder if we need some general code for all race checks. > > Thanks. > > -- > Best Regards > Yan Zi
Powered by blists - more mailing lists