Messages in this thread | | | Date | Mon, 1 Aug 2022 18:31:45 +0530 | Subject | Re: [PATCH V2] mm: fix use-after free of page_ext after race with memory-offline | From | Charan Teja Kalla <> |
| |
Thanks Michal !!
On 8/1/2022 1:57 PM, Michal Hocko wrote: >> Currently not all the places where page_ext is being used is put under >> the rcu_lock. I just used rcu lock in the places where it is possible to >> have the use-after-free of page_ext. You recommend to use rcu lock while >> using with page_ext in all the places? > Yes. Using locking inconsistently just begs for future problems. There > should be a very good reason to use lockless approach in some paths and > that would be where the locking overhead is not really acceptable or > when the locking cannot be used for other reasons. > > RCU read lock is essentially zero overhead so the only reason would be > that the critical section would require to sleep. Is any of that the > case? > > If there is a real need to have a lockless variant then I would propose > to add __page_ext_get/put which would be lockless and clearly documented > under which contexts it can be used and enfore those condictions (e.g. > reference count assumption). >
Let me try to use a single interface here.
>> The roll back operation in the online_page_ext(), where we free the >> allocated page_ext's, will not have the PAGE_EXT_INVALID flag thus >> WARN() may not work here. no? > Wouldn't ms->page_ext be NULL in that case? I don't think that ms->page_ext would be NULL here. online_page_ext(): (a) for (pfn = start; !fail && pfn < end; pfn += PAGES_PER_SECTION) fail = init_section_page_ext(): ms->page_ext = (void *)base - page_ext_size * pfn;
//If fail = -ERROR in the middle, roll back operation. (b) for (pfn = start; pfn < end; pfn += PAGES_PER_SECTION) __free_page_ext();
Here (b) can be called on the sections without PAGE_EXT_INVALID with ms->page_ext != NULL.
Thanks, Charan
| |