linux-kernel - Re: [External] Re: [PATCH] writeback: fix obtain a reference to a freeing memcg css

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 31 Mar 2021 20:18:01 +0800
From:   Muchun Song <songmuchun@...edance.com>
To:     Matthew Wilcox <willy@...radead.org>
Cc:     Alexander Viro <viro@...iv.linux.org.uk>,
        Tejun Heo <tj@...nel.org>, axboe@...com,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [External] Re: [PATCH] writeback: fix obtain a reference to a
 freeing memcg css

On Tue, Mar 30, 2021 at 7:34 PM Matthew Wilcox <willy@...radead.org> wrote:
>
> On Tue, Mar 30, 2021 at 05:29:33PM +0800, Muchun Song wrote:
> > +++ b/fs/fs-writeback.c
> > @@ -506,8 +506,10 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
> >       /* find and pin the new wb */
> >       rcu_read_lock();
> >       memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
> > -     if (memcg_css)
> > +     if (memcg_css && css_tryget(memcg_css)) {
> >               isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC);
> > +             css_put(memcg_css);
> > +     }
> >       rcu_read_unlock();
> >       if (!isw->new_wb)
> >               goto out_free;
>
> This seems like an unnecessary use of GFP_ATOMIC.  Why not:
>
>         rcu_read_lock();
>         memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
>         if (memcg_css && !css_tryget(memcg_css))
>                 memcg_css = NULL;
>         rcu_read_unlock();
>         if (!memcg_css)
>                 goto out_free;
>         isw->new_wb = wb_get_create(bdi, memcg_css, GFP_NOIO);
>         css_put(memcg_css);
>         if (!isw->new_wb)
>                 goto out_free;

Thanks. I will reuse this.

>
> (inode_switch_wbs can't be called in interrupt context because it takes
> inode->i_lock, which is not interrupt-safe.  it's not clear to me whether
> it is allowed to start IO or do FS reclaim, given where it is in the
> I/O path, so i went with GFP_NOIO rather than GFP_KERNEL)
>
> (also there's another use of GFP_ATOMIC in that function, which is
> probably wrong)

Do you mean the allocation of struct inode_switch_wbs_context in
inode_switch_wbs?