linux-kernel - Re: [PATCH] mm, slub: place the trace before freeing memory in kmem_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 2 Nov 2021 09:41:50 +0100
From:   Vlastimil Babka <vbabka@...e.cz>
To:     John Hubbard <jhubbard@...dia.com>,
        Yunfeng Ye <yeyunfeng@...wei.com>, cl@...ux.com,
        penberg@...nel.org, rientjes@...gle.com, iamjoonsoo.kim@....com,
        Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Cc:     wuxu.wu@...wei.com, Hewenliang <hewenliang4@...wei.com>
Subject: Re: [PATCH] mm, slub: place the trace before freeing memory in
 kmem_cache_free()

On 11/2/21 08:03, John Hubbard wrote:
> On 10/30/21 03:11, Yunfeng Ye wrote:
>> After the memory is freed, it may be allocated by other CPUs and has
>> been recorded by trace. So the timing sequence of the memory tracing is
>> inaccurate.
>>
>> For example, we expect the following timing sequeuce:
>>
>>      CPU 0                 CPU 1
>>
>>    (1) alloc xxxxxx
>>    (2) free  xxxxxx
>>                           (3) alloc xxxxxx
>>                           (4) free  xxxxxx
>>
>> However, the following timing sequence may occur:
>>
>>      CPU 0                 CPU 1
>>
>>    (1) alloc xxxxxx
>>                           (2) alloc xxxxxx
>>    (3) free  xxxxxx
>>                           (4) free  xxxxxx
>>
>> So place the trace before freeing memory in kmem_cache_free().
> 
> Hi Yunfeng,
> 
> Like Muchun, I had some difficulty with the above description, but
> now I think I get it. :)
> 
> In order to make it easier for others, how about this wording and subject
> line, instead:
> 
> 
> mm, slub: emit the "free" trace report before freeing memory in
> kmem_cache_free()
> 
> After the memory is freed, it can be immediately allocated by other
> CPUs, before the "free" trace report has been emitted. This causes
> inaccurate traces.
> 
> For example, if the following sequence of events occurs:
> 
>     CPU 0                 CPU 1
> 
>   (1) alloc xxxxxx
>   (2) free  xxxxxx
>                          (3) alloc xxxxxx
>                          (4) free  xxxxxx
> 
> ...then they will be inaccurately reported via tracing, so that they
> appear to have happened in this order. This makes it look like CPU 1
> somehow managed to allocate mmemory that CPU 0 still had allocated for
> itself:
> 
>     CPU 0                 CPU 1
> 
>   (1) alloc xxxxxx
>                          (2) alloc xxxxxx
>   (3) free  xxxxxx
>                          (4) free  xxxxxx
> 
> In order to avoid this, emit the "free xxxxxx" tracing report just
> before the actual call to free the memory, instead of just after it.

Agree, this wording is better.
IIRC the same problem was fixed for mmap_lock trace ordering just recently.

>> Signed-off-by: Yunfeng Ye <yeyunfeng@...wei.com>

Reviewed-by: Vlastimil Babka <vbabka@...e.cz>