All of lore.kernel.org
 help / color / mirror / Atom feed
From: Catalin Marinas <catalin.marinas@arm.com>
To: Jianyong Wu <jianyong.wu@arm.com>
Cc: will@kernel.org, anshuman.khandual@arm.com,
	akpm@linux-foundation.org, ardb@kernel.org,
	linux-kernel@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, david@redhat.com,
	gshan@redhat.com, justin.he@arm.com, nd@arm.com,
	Mark Rutland <mark.rutland@arm.com>
Subject: Re: [PATCH v2] arm64/mm: avoid fixmap race condition when create pud mapping
Date: Fri, 10 Dec 2021 11:22:09 +0000	[thread overview]
Message-ID: <YbM4YTgXryp45ufk@arm.com> (raw)
In-Reply-To: <20211210095432.51798-1-jianyong.wu@arm.com>

On Fri, Dec 10, 2021 at 05:54:32PM +0800, Jianyong Wu wrote:
> fixmap is a global resource and is used recursively in create pud mapping.
> It may lead to race condition when alloc_init_pud is called concurrently.
> 
> Fox example:
> alloc_init_pud is called when kernel_init. If memory hotplug
> thread, which will also call alloc_init_pud, happens during
> kernel_init, the race for fixmap occurs.
> 
> The race condition flow can be:
> 
> *************** begin **************
> 
> kerenl_init thread                          virtio-mem workqueue thread
> ==================                          ======== ==================
> alloc_init_pud(...)
>   pudp = pud_set_fixmap_offset(..)          alloc_init_pud(...)
> ...                                         ...
>     READ_ONCE(*pudp) //OK!                    pudp = pud_set_fixmap_offset(
> ...                                         ...
>   pud_clear_fixmap() //fixmap break
>                                               READ_ONCE(*pudp) //CRASH!
> 
> **************** end ***************
> 
> Hence, a spin lock is introduced to protect the fixmap during create pdg
> mapping.
> 
> Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>

It looks fine to me:

Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>

Do we need a cc stable? Fixmap was introduced in 4.6, so usually:

Fixes: f4710445458c ("arm64: mm: use fixmap when creating page tables")
Cc: <stable@vger.kernel.org> # 4.6.x

but I haven't checked when memory hotplug was added to be able to
trigger the race. It may not need to go back that far.

-- 
Catalin

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

WARNING: multiple messages have this Message-ID (diff)
From: Catalin Marinas <catalin.marinas@arm.com>
To: Jianyong Wu <jianyong.wu@arm.com>
Cc: will@kernel.org, anshuman.khandual@arm.com,
	akpm@linux-foundation.org, ardb@kernel.org,
	linux-kernel@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, david@redhat.com,
	gshan@redhat.com, justin.he@arm.com, nd@arm.com,
	Mark Rutland <mark.rutland@arm.com>
Subject: Re: [PATCH v2] arm64/mm: avoid fixmap race condition when create pud mapping
Date: Fri, 10 Dec 2021 11:22:09 +0000	[thread overview]
Message-ID: <YbM4YTgXryp45ufk@arm.com> (raw)
In-Reply-To: <20211210095432.51798-1-jianyong.wu@arm.com>

On Fri, Dec 10, 2021 at 05:54:32PM +0800, Jianyong Wu wrote:
> fixmap is a global resource and is used recursively in create pud mapping.
> It may lead to race condition when alloc_init_pud is called concurrently.
> 
> Fox example:
> alloc_init_pud is called when kernel_init. If memory hotplug
> thread, which will also call alloc_init_pud, happens during
> kernel_init, the race for fixmap occurs.
> 
> The race condition flow can be:
> 
> *************** begin **************
> 
> kerenl_init thread                          virtio-mem workqueue thread
> ==================                          ======== ==================
> alloc_init_pud(...)
>   pudp = pud_set_fixmap_offset(..)          alloc_init_pud(...)
> ...                                         ...
>     READ_ONCE(*pudp) //OK!                    pudp = pud_set_fixmap_offset(
> ...                                         ...
>   pud_clear_fixmap() //fixmap break
>                                               READ_ONCE(*pudp) //CRASH!
> 
> **************** end ***************
> 
> Hence, a spin lock is introduced to protect the fixmap during create pdg
> mapping.
> 
> Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>

It looks fine to me:

Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>

Do we need a cc stable? Fixmap was introduced in 4.6, so usually:

Fixes: f4710445458c ("arm64: mm: use fixmap when creating page tables")
Cc: <stable@vger.kernel.org> # 4.6.x

but I haven't checked when memory hotplug was added to be able to
trigger the race. It may not need to go back that far.

-- 
Catalin

  reply	other threads:[~2021-12-10 11:24 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-10  9:54 [PATCH v2] arm64/mm: avoid fixmap race condition when create pud mapping Jianyong Wu
2021-12-10  9:54 ` Jianyong Wu
2021-12-10 11:22 ` Catalin Marinas [this message]
2021-12-10 11:22   ` Catalin Marinas
2021-12-13  5:24   ` Jianyong Wu
2021-12-13  5:24     ` Jianyong Wu
2021-12-13  6:56 ` Anshuman Khandual
2021-12-13  6:56   ` Anshuman Khandual
2021-12-13  7:27   ` Jianyong Wu
2021-12-13  7:27     ` Jianyong Wu
2021-12-13  7:37     ` David Hildenbrand
2021-12-13  7:37       ` David Hildenbrand
2021-12-13  9:57       ` Catalin Marinas
2021-12-13  9:57         ` Catalin Marinas
2021-12-13 10:16 ` Anshuman Khandual
2021-12-13 10:16   ` Anshuman Khandual
2021-12-13 10:35   ` Ard Biesheuvel
2021-12-13 10:35     ` Ard Biesheuvel
2021-12-13 13:45     ` Will Deacon
2021-12-13 13:45       ` Will Deacon
2021-12-13 14:01       ` Ard Biesheuvel
2021-12-13 14:01         ` Ard Biesheuvel
2021-12-13 16:42 ` Will Deacon
2021-12-13 16:42   ` Will Deacon
2021-12-15 14:13 ` Qian Cai
2021-12-15 14:13   ` Qian Cai
2021-12-15 16:02   ` Catalin Marinas
2021-12-15 16:02     ` Catalin Marinas
2021-12-15 16:04     ` David Hildenbrand
2021-12-15 16:04       ` David Hildenbrand
2021-12-16  3:00       ` Jianyong Wu
2021-12-16  3:00         ` Jianyong Wu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YbM4YTgXryp45ufk@arm.com \
    --to=catalin.marinas@arm.com \
    --cc=akpm@linux-foundation.org \
    --cc=anshuman.khandual@arm.com \
    --cc=ardb@kernel.org \
    --cc=david@redhat.com \
    --cc=gshan@redhat.com \
    --cc=jianyong.wu@arm.com \
    --cc=justin.he@arm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=nd@arm.com \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.