linux-kernel - Re: [PATCH v3 07/13] mm, swap: hold a reference during scan and cleanup flag usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMgjq7CiOFPRuxfEShkemJB9+tOJEw4sYFSndBE0pvNTEQH+YQ@mail.gmail.com>
Date: Mon, 27 Jan 2025 17:19:22 +0800
From: Kairui Song <ryncsn@...il.com>
To: Baoquan He <bhe@...hat.com>
Cc: linux-mm@...ck.org, Andrew Morton <akpm@...ux-foundation.org>, 
	Chris Li <chrisl@...nel.org>, Barry Song <v-songbaohua@...o.com>, 
	Ryan Roberts <ryan.roberts@....com>, Hugh Dickins <hughd@...gle.com>, 
	Yosry Ahmed <yosryahmed@...gle.com>, "Huang, Ying" <ying.huang@...ux.alibaba.com>, 
	Nhat Pham <nphamcs@...il.com>, Johannes Weiner <hannes@...xchg.org>, 
	Kalesh Singh <kaleshsingh@...gle.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 07/13] mm, swap: hold a reference during scan and
 cleanup flag usage

On Mon, Jan 20, 2025 at 10:39 AM Baoquan He <bhe@...hat.com> wrote:
>
> On 01/13/25 at 01:34pm, Kairui Song wrote:
> > On Sat, Jan 4, 2025 at 1:46 PM Baoquan He <bhe@...hat.com> wrote:
> > >
> > > On 12/31/24 at 01:46am, Kairui Song wrote:
> > > > From: Kairui Song <kasong@...cent.com>
> > > >
> > > > The flag SWP_SCANNING was used as an indicator of whether a device
> > > > is being scanned for allocation, and prevents swapoff. Combined with
> > > > SWP_WRITEOK, they work as a set of barriers for a clean swapoff:
> > > >
> > > > 1. Swapoff clears SWP_WRITEOK, allocation requests will see
> > > >    ~SWP_WRITEOK and abort as it's serialized by si->lock.
> > > > 2. Swapoff unuses all allocated entries.
> > > > 3. Swapoff waits for SWP_SCANNING flag to be cleared, so ongoing
> > > >    allocations will stop, preventing UAF.
> > > > 4. Now swapoff can free everything safely.
> > > >
> > > > This will make the allocation path have a hard dependency on
> > > > si->lock. Allocation always have to acquire si->lock first for
> > > > setting SWP_SCANNING and checking SWP_WRITEOK.
> > > >
> > > > This commit removes this flag, and just uses the existing per-CPU
> > > > refcount instead to prevent UAF in step 3, which serves well for
> > > > such usage without dependency on si->lock, and scales very well too.
> > > > Just hold a reference during the whole scan and allocation process.
> > > > Swapoff will kill and wait for the counter.
> > > >
> > > > And for preventing any allocation from happening after step 1 so the
> > > > unuse in step 2 can ensure all slots are free, swapoff will acquire
> > > > the ci->lock of each cluster one by one to ensure all allocations
> > > > see ~SWP_WRITEOK and abort.
> > >
> > > Changing to use si->users is great, while wondering why we need acquire =
> > > each ci->lock now. After setup 1, we have cleared SWP_WRITEOK, and take
> > > the si off swap_avail_heads list. No matter what, we just need wait for
> > > p->comm's completion and continue, why bothering to loop for the
> > > ci->lock acquiring?
> > >
> >
> > Hi Baoquan,
> >
> > Waiting for p->comm's completion must be done after unuse is called
> > (unuse will need to take the si->users refcound, so it can't be dead
> > yet), but unuse must be called after no one will allocate any new
> > entry. That is guaranteed by the loop ci->lock acquiring.
>
> Sorry for late response, Kairui. I went trought the code flow of swap
> allocation several times, however haven't made clear how loop ci->lock
> acquiring is needed here.  Once si->flags &= ~SWP_WRITEOK is executed in
> del_from_avail_list() when swaping off, even though the allocation
> action is still on going, it will be failed in cluster_alloc_range()
> by the 'if (!(si->flags & SWP_WRITEOK))' checking. Then that allocation

Hi Baoquan,

Thanks for the careful review.

> requirement will be failed and returned, means no new swap entry|slot
> allcation will be done. Then unuse won't be impacted at all. In this
> case, why do we care about it?
>
> Please forgive my stupidity, could you elaborate in which case this kind
> of still ongoging swap allocation will happen during its swap device's
> off? Could you give an example of the concurrent execution flows?

There is no barrier or lock between clear the flag and try_to_unuse,
so nothing guarantees the "if (!(si->flags & SWP_WRITEOK))" in
cluster_alloc_range will see the updated flag. The loop ci->lock acts
like a full memory barrier, ensuring any allocation after the loop
lock will definitely see the updated flags, and try_to_unuse will only
go on after all allocation have either stopped or will see the updated
flags. In practice this problem is almost impossible to happen, but in
theory possible.

>
> Thanks
> Baoquan
>