linux-kernel - Re: [RFC PATCH v1] mm: improve call_controls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHOvCC6ZPyi=tMK9YhcuWPEzdnTje1ADCWzhs7uJCwHh3SMHpg@mail.gmail.com>
Date: Wed, 31 Dec 2025 15:10:12 +0900
From: JaeJoon Jung <rgbi3307@...il.com>
To: SeongJae Park <sj@...nel.org>
Cc: Asier Gutierrez <gutierrez.asier@...wei-partners.com>, akpm@...ux-foundation.org, 
	damon@...ts.linux.dev, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	wangkefeng.wang@...wei.com, artem.kuzin@...wei.com, 
	stepanov.anatoly@...wei.com
Subject: Re: [RFC PATCH v1] mm: improve call_controls_lock

On Wed, 31 Dec 2025 at 13:59, SeongJae Park <sj@...nel.org> wrote:
>
> On Wed, 31 Dec 2025 11:15:00 +0900 JaeJoon Jung <rgbi3307@...il.com> wrote:
>
> > On Tue, 30 Dec 2025 at 00:23, SeongJae Park <sj@...nel.org> wrote:
> > >
> > > Hello Asier,
> > >
> > >
> > > Thank you for sending this patch!
> > >
> > > On Mon, 29 Dec 2025 14:55:32 +0000 Asier Gutierrez <gutierrez.asier@...wei-partners.com> wrote:
> > >
> > > > This is a minor patch set for a call_controls_lock synchronization improvement.
> > >
> > > Please break description lines to not exceed 75 characters per line.
> > >
> > > >
> > > > Spinlocks are faster than mutexes, even when the mutex takes the fast
> > > > path. Hence, this patch replaces the mutex call_controls_lock with a spinlock.
> > >
> > > But call_controls_lock is not being used on performance critical part.
> > > Actually, most of DAMON code is not performance critical.  I really appreciate
> > > your patch, but I have to say I don't think this change is really needed now.
> > > Please let me know if I'm missing something.
> >
> > Paradoxically, when it comes to locking, spin_lock is better than
> > mutex_lock
> > because "most of DAMON code is not performance critical."
> >
> > DAMON code only accesses the ctx belonging to kdamond itself. For
> > example:
> > kdamond.0 --> ctx.0
> > kdamond.1 --> ctx.1
> > kdamond.2 --> ctx.2
> > kdamond.# --> ctx.#
> >
> > There is no cross-approach as shown below:
> > kdamond.0 --> ctx.1
> > kdamond.1 --> ctx.2
> > kdamond.2 --> ctx.0
> >
> > Only the data belonging to kdamond needs to be resolved for concurrent access.
> > most DAMON code needs to lock/unlock briefly when add/del linked
> > lists,
> > so spin_lock is effective.
>
> I don't disagree this.  Both spinlock and mutex effectively work for DAMON's
> locking usages.
>
> > If you handle it with a mutex, it becomes
> > more
> > complicated because the rescheduling occurs as a context switch occurs
> > inside the kernel.
>
> Can you please elaborate what kind of complexities you are saying about?
> Adding some examples would be nice.
>
> > Moreover, since the call_controls_lock that is
> > currently
> > being raised as a problem only occurs in two places, the kdamon_call()
> > loop
> > and the damon_call() function, it is effective to handle it with a
> > spin_lock
> > as shown below.
> >
> > @@ -1502,14 +1501,15 @@ int damon_call(struct damon_ctx *ctx, struct
> > damon_call_control *control)
> >         control->canceled = false;
> >         INIT_LIST_HEAD(&control->list);
> >
> > -       mutex_lock(&ctx->call_controls_lock);
> > +       spin_lock(&ctx->call_controls_lock);
> > +       /* damon_is_running */
> >         if (ctx->kdamond) {
> >                 list_add_tail(&control->list, &ctx->call_controls);
> >         } else {
> > -               mutex_unlock(&ctx->call_controls_lock);
> > +               spin_unlock(&ctx->call_controls_lock);
> >                 return -EINVAL;
> >         }
> > -       mutex_unlock(&ctx->call_controls_lock);
> > +       spin_unlock(&ctx->call_controls_lock);
> >
> >         if (control->repeat)
> >                 return 0;
>
> Are you saying the above diff can fix the damon_call() use-after-free bug [1]?
> Can you please elaborate why you think so?
>
> [1] https://lore.kernel.org/20251231012315.75835-1-sj@kernel.org
>

The above code works fine with spin_lock.  However, when booting the kernel,
the spin_lock call trace from damon_call() is output as follows:
If you have any experience with the following, please share it.

[    0.834450] Call Trace:
[    0.834456] [<ffffffff8001b376>] dump_backtrace+0x1c/0x24
[    0.834471] [<ffffffff800024e0>] show_stack+0x28/0x34
[    0.834480] [<ffffffff80014f4c>] dump_stack_lvl+0x48/0x66
[    0.834493] [<ffffffff80014f7e>] dump_stack+0x14/0x1c
[    0.834503] [<ffffffff800032c6>] spin_dump+0x62/0x6e
[    0.834511] [<ffffffff80087376>] do_raw_spin_lock+0xd0/0x128
[    0.834523] [<ffffffff80de9378>] _raw_spin_lock+0x1a/0x22
[    0.834538] [<ffffffff80255c0c>] damon_call+0x38/0x100
[    0.834548] [<ffffffff8025f022>] damon_stat_start+0x10e/0x168
[    0.834558] [<ffffffff80e21ab4>] damon_stat_init+0x2a/0x44
[    0.834568] [<ffffffff800157c0>] do_one_initcall+0x40/0x202
[    0.834579] [<ffffffff80e015f6>] kernel_init_freeable+0x1fc/0x27e
[    0.834588] [<ffffffff80de0a9e>] kernel_init+0x1e/0x13c
[    0.834599] [<ffffffff8001716a>] ret_from_fork_kernel+0x10/0xf8
[    0.834607] [<ffffffff80deab22>] ret_from_fork_kernel_asm+0x16/0x18
[    0.943407] NFS: Registering the id_resolver key type
[    0.948996] Key type id_resolver registered
[    0.953614] Key type id_legacy registered

Thanks,
JaeJoon

>
> Thanks,
> SJ
>
> [...]