linux-kernel - Re: [PATCH] writeback: fix obtain a reference to a freeing memcg css

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210330113447.GM351017@casper.infradead.org>
Date:   Tue, 30 Mar 2021 12:34:47 +0100
From:   Matthew Wilcox <willy@...radead.org>
To:     Muchun Song <songmuchun@...edance.com>
Cc:     viro@...iv.linux.org.uk, tj@...nel.org, axboe@...com,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] writeback: fix obtain a reference to a freeing memcg css

On Tue, Mar 30, 2021 at 05:29:33PM +0800, Muchun Song wrote:
> +++ b/fs/fs-writeback.c
> @@ -506,8 +506,10 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
>  	/* find and pin the new wb */
>  	rcu_read_lock();
>  	memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
> -	if (memcg_css)
> +	if (memcg_css && css_tryget(memcg_css)) {
>  		isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC);
> +		css_put(memcg_css);
> +	}
>  	rcu_read_unlock();
>  	if (!isw->new_wb)
>  		goto out_free;

This seems like an unnecessary use of GFP_ATOMIC.  Why not:

	rcu_read_lock();
	memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
	if (memcg_css && !css_tryget(memcg_css))
		memcg_css = NULL;
	rcu_read_unlock();
	if (!memcg_css)
		goto out_free;
	isw->new_wb = wb_get_create(bdi, memcg_css, GFP_NOIO);
	css_put(memcg_css);
	if (!isw->new_wb)
		goto out_free;

(inode_switch_wbs can't be called in interrupt context because it takes
inode->i_lock, which is not interrupt-safe.  it's not clear to me whether
it is allowed to start IO or do FS reclaim, given where it is in the
I/O path, so i went with GFP_NOIO rather than GFP_KERNEL)

(also there's another use of GFP_ATOMIC in that function, which is
probably wrong)