From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01DDDC00140 for ; Wed, 10 Aug 2022 08:27:59 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6875C8E0002; Wed, 10 Aug 2022 04:27:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 636BF8E0001; Wed, 10 Aug 2022 04:27:59 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4FEB48E0002; Wed, 10 Aug 2022 04:27:59 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 4120E8E0001 for ; Wed, 10 Aug 2022 04:27:59 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 12FB3141303 for ; Wed, 10 Aug 2022 08:27:59 +0000 (UTC) X-FDA: 79783005078.22.187AAAF Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) by imf08.hostedemail.com (Postfix) with ESMTP id 80393160049 for ; Wed, 10 Aug 2022 08:27:58 +0000 (UTC) Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27A7p73A026468; Wed, 10 Aug 2022 08:27:46 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=message-id : date : mime-version : subject : to : cc : references : from : in-reply-to : content-type : content-transfer-encoding; s=qcppdkim1; bh=JyH63/DzufmeL7nG259GtZLuQ0XDp5qO2kFdMG1yuIM=; b=DM7f2eLuGJTTvAzutMYfqmDK6LfZxBtnsjhwo7QZ38H2b1Y5LBxhD2Og4hRg/qfdH1VE dj8TJ3gDMuLYJwUXqeUJ0782E8EuZDcUUwKPmc7eWGN3STdeVjpb4LWHrTeZ8D9VpEZY DvGTumXba60TouprRvYqflao3N5/5a25OB1ECocD9jEWvhKQTY+KUgUOak1LGicEhz2K /OAqrMJxNcg+0AFIEUfi6CjPkk4YnmamOUzM3FG0M+DVvhn15p9YYHtPOPQkzAWKXS+N sXHHisseIAW5wRvh7uYT8ffc8hIyBM9rWTVWGsT6rbnFm9BHCnhNKbhsOCQ2oMC8EB+F lQ== Received: from nasanppmta01.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3huwqe1rn8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 10 Aug 2022 08:27:46 +0000 Received: from pps.filterd (NASANPPMTA01.qualcomm.com [127.0.0.1]) by NASANPPMTA01.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTP id 27A8Rk1j026893; Wed, 10 Aug 2022 08:27:46 GMT Received: from pps.reinject (localhost [127.0.0.1]) by NASANPPMTA01.qualcomm.com (PPS) with ESMTPS id 3hshckc8fw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 10 Aug 2022 08:27:46 +0000 Received: from NASANPPMTA01.qualcomm.com (NASANPPMTA01.qualcomm.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 27A8IYAB007390; Wed, 10 Aug 2022 08:27:46 GMT Received: from nasanex01c.na.qualcomm.com (nasanex01c.na.qualcomm.com [10.47.97.222]) by NASANPPMTA01.qualcomm.com (PPS) with ESMTPS id 27A8Rjpw026888 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 10 Aug 2022 08:27:45 +0000 Received: from nalasex01a.na.qualcomm.com (10.47.209.196) by nasanex01c.na.qualcomm.com (10.47.97.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.22; Wed, 10 Aug 2022 01:27:45 -0700 Received: from [10.216.32.73] (10.80.80.8) by nalasex01a.na.qualcomm.com (10.47.209.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.22; Wed, 10 Aug 2022 01:27:40 -0700 Message-ID: <3aab7518-ff57-abdb-8bab-ea581197a07e@quicinc.com> Date: Wed, 10 Aug 2022 13:57:37 +0530 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.9.1 Subject: Re: [PATCH V3] mm: fix use-after free of page_ext after race with memory-offline Content-Language: en-US To: Michal Hocko , Andrew Morton CC: , , , , , , , , , , Minchan Kim References: <1660056403-20894-1-git-send-email-quic_charante@quicinc.com> <20220809185714.5af7057c1270b11079cb196a@linux-foundation.org> From: Charan Teja Kalla In-Reply-To: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nalasex01a.na.qualcomm.com (10.47.209.196) X-QCInternal: smtphost X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-GUID: Y8tFQTZ82Hz8mefPlE0m5I5fV6vmkqXz X-Proofpoint-ORIG-GUID: Y8tFQTZ82Hz8mefPlE0m5I5fV6vmkqXz X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-10_03,2022-08-09_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 clxscore=1011 priorityscore=1501 mlxscore=0 adultscore=0 impostorscore=0 malwarescore=0 bulkscore=0 mlxlogscore=690 phishscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208100024 ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1660120078; a=rsa-sha256; cv=none; b=dW6s8+xakWYRSer3l1odz3HSpy/pPP/lxZyP7kCoFhqGcaYyM+Bym5Fc9/1XRKtbiISBi2 LZY4tpYrRHpDCfuhbhdsqQuspHKOfghc8Sr3hEaERfCUMj5Jn3fqfCwDsOuHl+5Akg7N0I elWrxOOavdQ8vlszqX+bfSosaF4HIWA= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=quicinc.com header.s=qcppdkim1 header.b=DM7f2eLu; spf=pass (imf08.hostedemail.com: domain of quic_charante@quicinc.com designates 205.220.168.131 as permitted sender) smtp.mailfrom=quic_charante@quicinc.com; dmarc=pass (policy=none) header.from=quicinc.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1660120078; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=JyH63/DzufmeL7nG259GtZLuQ0XDp5qO2kFdMG1yuIM=; b=aZXlzf/I7CHc4/KdPgt7Cktqa1Gnf/VuQ+NqFm03h68dqjZ3kDA0AQ+2McXeFZ8t77vDif CvyqLk+HpW3SO0O83L+CRARAiSu7xKJzAFiiWfrGAtmXppINK0qnRtTP/hmiuF8ZzogoYd D/8/4Vfvs1RSNwmPIJTqnh0AxgyUQSg= X-Rspamd-Queue-Id: 80393160049 X-Rspam-User: X-Rspamd-Server: rspam11 Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=quicinc.com header.s=qcppdkim1 header.b=DM7f2eLu; spf=pass (imf08.hostedemail.com: domain of quic_charante@quicinc.com designates 205.220.168.131 as permitted sender) smtp.mailfrom=quic_charante@quicinc.com; dmarc=pass (policy=none) header.from=quicinc.com X-Stat-Signature: cusetkxt1g9oimwy3nchzxrc7qnm6m8j X-HE-Tag: 1660120078-994468 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Thanks Andrew/Michal!! On 8/10/2022 12:53 PM, Michal Hocko wrote: > On Tue 09-08-22 18:57:14, Andrew Morton wrote: >> On Tue, 9 Aug 2022 20:16:43 +0530 Charan Teja Kalla wrote: >> >>> The below is one path where race between page_ext and offline of the >>> respective memory blocks will cause use-after-free on the access of >>> page_ext structure. >> >> Has this race ever been observed at runtime? >> >> Given the size of the fix, I'm looking for excuses to not backport it >> into -stable kernels! > > I believe this is quite theoretical for two reasons > 1) the memory hotplug (offlining) is quite rare operation > 2) with all the retries the race window is quite hard to trigger > > So this is good to have address long term but nothing really for stable > until somebody actually hits that with a real world workload. > Actually in the embedded systems the offline is not a rare operation, especially, in cases where one want to save some power through PASR[1]. This issue is caught with and in the page_pinner[2](currently being used in Android) path where it is accessing the page_ext of a page after it is freed. This is again not with the real workload but with some stress tests. So, I am also agree with Michal here to not to backport it. [1]https://lwn.net/Articles/478049/ [2] https://lore.kernel.org/all/20211228175904.3739751-1-minchan@kernel.org/ > Btw. I plan to have a look and review this but times are busy. Hopefully > soon. > > Thanks! >