lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 10 Mar 2020 10:07:06 -0700
From:   "Jonathan Lemon" <>
To:     "Saeed Mahameed" <>
Subject: Re: [PATCH] page_pool: use irqsave/irqrestore to protect ring access.

On 9 Mar 2020, at 19:30, Saeed Mahameed wrote:

> On Mon, 2020-03-09 at 17:55 -0700, David Miller wrote:
>> From: Jonathan Lemon <>
>> Date: Mon, 9 Mar 2020 12:49:29 -0700
>>> netpoll may be called from IRQ context, which may access the
>>> page pool ring.  The current _bh variants do not provide sufficient
>>> protection, so use irqsave/restore instead.
>>> Error observed on a modified mlx4 driver, but the code path exists
>>> for any driver which calls page_pool_recycle from napi poll.
>>> WARNING: CPU: 34 PID: 550248 at /ro/source/kernel/softirq.c:161
>> __local_bh_enable_ip+0x35/0x50
>>  ...
>>> Signed-off-by: Jonathan Lemon <>
>> The netpoll stuff always makes the locking more complicated than it
>> needs
>> to be.  I wonder if there is another way around this issue?
>> Because IRQ save/restore is a high cost to pay in this critical path.
> a printk inside irq context lead to this, so maybe it can be avoided ..

This was caused by a printk in hpet_rtc_timer_reinit() complaining about
RTC interrupts being lost.  I'm not sure it's practical trying to locate
all the printk cases like this.

> or instead of checking in_serving_softirq()  change page_pool to
> check in_interrupt() which is more powerful, to avoid ptr_ring locking
> and the complication with netpoll altogether.

That's another approach:

    ret = 1;
    if (!in_irq()) {
        if (in_serving_softirq())
            ret = ptr_ring_produce(....
            ret = ptr_ring_produce_bh(....

which would return failure and release the page from the page pool.
This doesn't address the allocation or the bulk release path.

> I wonder why Jesper picked in_serving_softirq() in first place, was
> there a specific reason ? or he just wanted it to be as less strict as
> possible ?

>From the code, it looks like he was optimizing to avoid the _bh variant
if possible.

Powered by blists - more mailing lists