netdev - Re: [PATCH net] net: fix race between napi kthread mode and busy poll

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+jO-ym4kpLD3NaeCKZL_sUiub=2VP574YgC-aVvVyTMw@mail.gmail.com>
Date:   Wed, 24 Feb 2021 21:37:36 +0100
From:   Eric Dumazet <edumazet@...gle.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Wei Wang <weiwan@...gle.com>,
        "David S . Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>, Paolo Abeni <pabeni@...hat.com>,
        Hannes Frederic Sowa <hannes@...essinduktion.org>,
        Alexander Duyck <alexanderduyck@...com>,
        Martin Zaharinov <micron10@...il.com>
Subject: Re: [PATCH net] net: fix race between napi kthread mode and busy poll

On Wed, Feb 24, 2021 at 8:48 PM Jakub Kicinski <kuba@...nel.org> wrote:
>
> On Tue, 23 Feb 2021 15:41:30 -0800 Wei Wang wrote:
> > Currently, napi_thread_wait() checks for NAPI_STATE_SCHED bit to
> > determine if the kthread owns this napi and could call napi->poll() on
> > it. However, if socket busy poll is enabled, it is possible that the
> > busy poll thread grabs this SCHED bit (after the previous napi->poll()
> > invokes napi_complete_done() and clears SCHED bit) and tries to poll
> > on the same napi.
> > This patch tries to fix this race by adding a new bit
> > NAPI_STATE_SCHED_BUSY_POLL in napi->state. This bit gets set in
> > napi_busy_loop() togther with NAPI_STATE_SCHED, and gets cleared in
> > napi_complete_done() together with NAPI_STATE_SCHED. This helps
> > distinguish the ownership of the napi between kthread and the busy poll
> > thread, and prevents the kthread from polling on the napi when this napi
> > is still owned by the busy poll thread.
> >
> > Fixes: 29863d41bb6e ("net: implement threaded-able napi poll loop support")
> > Reported-by: Martin Zaharinov <micron10@...il.com>
> > Suggested-by: Alexander Duyck <alexanderduyck@...com>
> > Reviewed-by: Alexander Duyck <alexanderduyck@...com>
> > Reviewed-by: Eric Dumazet <edumazet@...gle.come>
>
> AFAIU sched bit controls the ownership of the poll_list

I disagree. BUSY POLL never inserted the napi into a list,
because the user thread was polling one napi.

Same for the kthread.

wake_up_process() should be good enough.

. Can we please
> add a poll_list for the thread and make sure the thread polls based on
> the list?

A list ? That would require a spinlock or something ?


> IMO that's far clearer than defining a forest of ownership state bits.

Adding a bit seems simpler than adding a list.

>
> I think with just the right (wrong?) timing this patch will still not
> protect against disabling the NAPI.

Maybe, but this patch is solving one issue that was easy to trigger.

disabling the NAPI is handled already.