linux-kernel - Re: [RFC PATCH v5 6/8] drivers: vmware: balloon

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 21 Oct 2022 06:50:33 +0000
From:   Nadav Amit <namit@...are.com>
To:     Alexander Atanasov <alexander.atanasov@...tuozzo.com>
CC:     Pv-drivers <Pv-drivers@...are.com>, Arnd Bergmann <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "kernel@...nvz.org" <kernel@...nvz.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH v5 6/8] drivers: vmware: balloon - report inflated
 memory

On Oct 19, 2022, at 12:56 PM, Alexander Atanasov <alexander.atanasov@...tuozzo.com> wrote:

> Update the inflated memory in the mm core on change.
> 
> Signed-off-by: Alexander Atanasov <alexander.atanasov@...tuozzo.com>
> ---
> drivers/misc/vmw_balloon.c | 1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
> index 91d4d2a285c5..3bfd845898f5 100644
> --- a/drivers/misc/vmw_balloon.c
> +++ b/drivers/misc/vmw_balloon.c
> @@ -1507,6 +1507,7 @@ static void vmballoon_work(struct work_struct *work)
> 	queue_delayed_work(system_freezable_wq,
> 			   dwork, round_jiffies_relative(HZ));
> 
> +	balloon_set_inflated_free(atomic64_read(&b->size) << 2);
> }

I don’t like it in general (I think that something like that should go into
some common infra).

But more concretely there are at least 2 problems here. First, queueing the
work should come last. Second, there are other places that change the
balloon size (e.g., vmballoon_reset()), which are not handled by this patch.

If you added calls to balloon_set_inflated_free() from these places, you can
get races while calling balloon_set_inflated_free() and the last value that
would be latched would be the wrong one. I don’t see anything in the logic
or comments that clarify how something like that should be resolved.