linux-kernel - Re: [PATCH 02/11] rcu: fix bug when rcu_exp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 1 Nov 2019 08:19:48 +0800
From:   Boqun Feng <boqun.feng@...il.com>
To:     "Paul E. McKenney" <paulmck@...nel.org>
Cc:     Lai Jiangshan <laijs@...ux.alibaba.com>,
        linux-kernel@...r.kernel.org,
        Josh Triplett <josh@...htriplett.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Lai Jiangshan <jiangshanlai@...il.com>,
        Joel Fernandes <joel@...lfernandes.org>, rcu@...r.kernel.org
Subject: Re: [PATCH 02/11] rcu: fix bug when rcu_exp_handler() in nested
 interrupt

On Thu, Oct 31, 2019 at 11:52:58AM -0700, Paul E. McKenney wrote:
> On Thu, Oct 31, 2019 at 11:14:23PM +0800, Lai Jiangshan wrote:
> > 
> > 
> > On 2019/10/31 10:31 下午, Paul E. McKenney wrote:
> > > On Thu, Oct 31, 2019 at 06:47:31AM -0700, Paul E. McKenney wrote:
> > > > On Thu, Oct 31, 2019 at 10:07:57AM +0000, Lai Jiangshan wrote:
> > > > > These is a possible bug (although which I can't triger yet)
> > > > > since 2015 8203d6d0ee78
> > > > > (rcu: Use single-stage IPI algorithm for RCU expedited grace period)
> > > > > 
> > > > >   rcu_read_unlock()
> > > > >    ->rcu_read_lock_nesting = -RCU_NEST_BIAS;
> > > > >    interrupt(); // before or after rcu_read_unlock_special()
> > > > >     rcu_read_lock()
> > > > >      fetch some rcu protected pointers
> > > > >      // exp GP starts in other cpu.
> > > > >      some works
> > > > >      NESTED interrupt for rcu_exp_handler();
> > > 
> > > Also, which platforms support nested interrupts?  Last I knew, this was
> > > prohibited.
> > > 
> > > > >        report exp qs! BUG!
> > > > 
> > > > Why would a quiescent state for the expedited grace period be reported
> > > > here?  This CPU is still in an RCU read-side critical section, isn't it?
> > > 
> > > And I now see what you were getting at here.  Yes, the current code
> > > assumes that interrupt-disabled regions, like hardware interrupt
> > > handlers, cannot be interrupted.  But if interrupt-disabled regions such
> > > as hardware interrupt handlers can be interrupted (as opposed to being
> > > NMIed), wouldn't that break a whole lot of stuff all over the place in
> > > the kernel?  So that sounds like an arch bug to me.
> > 
> > I don't know when I started always assuming hardware interrupt
> > handler can be nested by (other) interrupt. I can't find any
> > documents say Linux don't allow nested interrupt handler.
> > Google search suggests the opposite.

FWIW, there is a LWN article talking about we disallow interrupt nesting
in *most* cases:

	https://lwn.net/Articles/380931/

, that's unless a interrupt handler explicitly calls
local_irq_enable_in_hardirq(), it remains irq disabled, which means no
nesting interrupt allowed.

Regards,
Boqun

> 
> The results I am seeing look to be talking about threaded interrupt
> handlers, which indeed can be interrupted by hardware interrupts.  As can
> softirq handlers.  But these are not examples of a hardware interrupt
> handler being interrupted by another hardware interrupt.  For that to
> work reasonably, something like a system priority level is required,
> as in the old DYNIX/ptx kernel, or, going even farther back, DEC's RT-11.
> 
> > grep -rIni nested Documentation/memory-barriers.txt Documentation/x86/
> > It still have some words about nested interrupt handler.
> 
> Some hardware does not differentiate between interrupts and exceptions,
> for example, an illegal-instruction trap within an interrupt handler
> might look in some ways like a nested interrupt.
> 
> > The whole patchset doesn't depend on this patch, and actually
> > it is reverted later in the patchset. Dropping this patch
> > can be an option for next round.
> 
> Sounds like a plan!
> 
> 							Thanx, Paul
> 
[...]