linux-kernel - Re: task_group unthrottling and removal race (was Re: [PATCH] sched/fair: Use rq->lock when checking cfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211103111036.GA10034@blackbody.suse.cz>
Date:   Wed, 3 Nov 2021 12:10:36 +0100
From:   Michal Koutný <mkoutny@...e.com>
To:     Mathias Krause <minipli@...ecurity.net>
Cc:     Vincent Guittot <vincent.guittot@...aro.org>,
        Odin Ugedal <odin@...d.al>,
        Kevin Tanguy <kevin.tanguy@...p.ovh.com>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Juri Lelli <juri.lelli@...hat.com>,
        Dietmar Eggemann <dietmar.eggemann@....com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ben Segall <bsegall@...gle.com>, Mel Gorman <mgorman@...e.de>,
        Daniel Bristot de Oliveira <bristot@...hat.com>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: task_group unthrottling and removal race (was Re: [PATCH]
 sched/fair: Use rq->lock when checking cfs_rq list) presence

On Wed, Nov 03, 2021 at 11:51:12AM +0100, Mathias Krause <minipli@...ecurity.net> wrote:
> Adding synchronize_rcu() here will ensure all concurrent RCU "readers"
> will have finished what they're doing, so we can unlink safely. That
> was, apparently, the missing piece.

What reader(s) are you referring to here? The
list_for_each_entry_rcu(cfs_rq, &cfs_b->throttled_cfs_rq,
throttled_list) in distribute_cfs_runtime()?

I'm think (not sure) that wouldn't work since the unthrottle_cfs_rq can
still be called after this synchronize_rcu() but before
free_fair_sched_group().

(But if you considered update_blocked_averages() as the reader(s) and
synchronize_rcu() within free_fair_sched_group(), that may ensure UBA
won't step on a free'd cfs_rq (+unlinking would need to happen only in
free_fair_sched_group() too.))

Michal