All of lore.kernel.org
 help / color / mirror / Atom feed
From: Catalin Marinas <catalin.marinas@arm.com>
To: Qian Cai <quic_qiancai@quicinc.com>
Cc: Jianyong Wu <jianyong.wu@arm.com>,
	will@kernel.org, anshuman.khandual@arm.com,
	akpm@linux-foundation.org, ardb@kernel.org,
	linux-kernel@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, david@redhat.com,
	gshan@redhat.com, justin.he@arm.com, nd@arm.com
Subject: Re: [PATCH v2] arm64/mm: avoid fixmap race condition when create pud mapping
Date: Wed, 15 Dec 2021 16:02:55 +0000	[thread overview]
Message-ID: <YboRr0BCgjAbYdHe@arm.com> (raw)
In-Reply-To: <Ybn4EfweLqKtyW0+@fixkernel.com>

On Wed, Dec 15, 2021 at 09:13:37AM -0500, Qian Cai wrote:
> On Fri, Dec 10, 2021 at 05:54:32PM +0800, Jianyong Wu wrote:
> > fixmap is a global resource and is used recursively in create pud mapping.
> > It may lead to race condition when alloc_init_pud is called concurrently.
> > 
> > Fox example:
> > alloc_init_pud is called when kernel_init. If memory hotplug
> > thread, which will also call alloc_init_pud, happens during
> > kernel_init, the race for fixmap occurs.
> > 
> > The race condition flow can be:
> > 
> > *************** begin **************
> > 
> > kerenl_init thread                          virtio-mem workqueue thread
> > ==================                          ======== ==================
> > alloc_init_pud(...)
> >   pudp = pud_set_fixmap_offset(..)          alloc_init_pud(...)
> > ...                                         ...
> >     READ_ONCE(*pudp) //OK!                    pudp = pud_set_fixmap_offset(
> > ...                                         ...
> >   pud_clear_fixmap() //fixmap break
> >                                               READ_ONCE(*pudp) //CRASH!
> > 
> > **************** end ***************
> > 
> > Hence, a spin lock is introduced to protect the fixmap during create pdg
> > mapping.
> > 
> > Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>
> 
> I am afraid there is a problem to take a spinlock there.
> 
> node 0 deferred pages initialised in 2740ms
>  pgdatinit0 (176) used greatest stack depth: 59184 bytes left
>  devtmpfs: initialized
>  KASLR disabled due to lack of seed
>  BUG: sleeping function called from invalid context at mm/page_alloc.c:5151

Thanks for the report. Definitely a bug, GFP_KERNEL_ACCOUNT allows for
the page allocator to sleep. I'll drop the patch from the arm64
for-next/fixes branch for now and sort it out later.

-- 
Catalin

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

WARNING: multiple messages have this Message-ID (diff)
From: Catalin Marinas <catalin.marinas@arm.com>
To: Qian Cai <quic_qiancai@quicinc.com>
Cc: Jianyong Wu <jianyong.wu@arm.com>,
	will@kernel.org, anshuman.khandual@arm.com,
	akpm@linux-foundation.org, ardb@kernel.org,
	linux-kernel@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, david@redhat.com,
	gshan@redhat.com, justin.he@arm.com, nd@arm.com
Subject: Re: [PATCH v2] arm64/mm: avoid fixmap race condition when create pud mapping
Date: Wed, 15 Dec 2021 16:02:55 +0000	[thread overview]
Message-ID: <YboRr0BCgjAbYdHe@arm.com> (raw)
In-Reply-To: <Ybn4EfweLqKtyW0+@fixkernel.com>

On Wed, Dec 15, 2021 at 09:13:37AM -0500, Qian Cai wrote:
> On Fri, Dec 10, 2021 at 05:54:32PM +0800, Jianyong Wu wrote:
> > fixmap is a global resource and is used recursively in create pud mapping.
> > It may lead to race condition when alloc_init_pud is called concurrently.
> > 
> > Fox example:
> > alloc_init_pud is called when kernel_init. If memory hotplug
> > thread, which will also call alloc_init_pud, happens during
> > kernel_init, the race for fixmap occurs.
> > 
> > The race condition flow can be:
> > 
> > *************** begin **************
> > 
> > kerenl_init thread                          virtio-mem workqueue thread
> > ==================                          ======== ==================
> > alloc_init_pud(...)
> >   pudp = pud_set_fixmap_offset(..)          alloc_init_pud(...)
> > ...                                         ...
> >     READ_ONCE(*pudp) //OK!                    pudp = pud_set_fixmap_offset(
> > ...                                         ...
> >   pud_clear_fixmap() //fixmap break
> >                                               READ_ONCE(*pudp) //CRASH!
> > 
> > **************** end ***************
> > 
> > Hence, a spin lock is introduced to protect the fixmap during create pdg
> > mapping.
> > 
> > Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>
> 
> I am afraid there is a problem to take a spinlock there.
> 
> node 0 deferred pages initialised in 2740ms
>  pgdatinit0 (176) used greatest stack depth: 59184 bytes left
>  devtmpfs: initialized
>  KASLR disabled due to lack of seed
>  BUG: sleeping function called from invalid context at mm/page_alloc.c:5151

Thanks for the report. Definitely a bug, GFP_KERNEL_ACCOUNT allows for
the page allocator to sleep. I'll drop the patch from the arm64
for-next/fixes branch for now and sort it out later.

-- 
Catalin

  reply	other threads:[~2021-12-15 16:05 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-10  9:54 [PATCH v2] arm64/mm: avoid fixmap race condition when create pud mapping Jianyong Wu
2021-12-10  9:54 ` Jianyong Wu
2021-12-10 11:22 ` Catalin Marinas
2021-12-10 11:22   ` Catalin Marinas
2021-12-13  5:24   ` Jianyong Wu
2021-12-13  5:24     ` Jianyong Wu
2021-12-13  6:56 ` Anshuman Khandual
2021-12-13  6:56   ` Anshuman Khandual
2021-12-13  7:27   ` Jianyong Wu
2021-12-13  7:27     ` Jianyong Wu
2021-12-13  7:37     ` David Hildenbrand
2021-12-13  7:37       ` David Hildenbrand
2021-12-13  9:57       ` Catalin Marinas
2021-12-13  9:57         ` Catalin Marinas
2021-12-13 10:16 ` Anshuman Khandual
2021-12-13 10:16   ` Anshuman Khandual
2021-12-13 10:35   ` Ard Biesheuvel
2021-12-13 10:35     ` Ard Biesheuvel
2021-12-13 13:45     ` Will Deacon
2021-12-13 13:45       ` Will Deacon
2021-12-13 14:01       ` Ard Biesheuvel
2021-12-13 14:01         ` Ard Biesheuvel
2021-12-13 16:42 ` Will Deacon
2021-12-13 16:42   ` Will Deacon
2021-12-15 14:13 ` Qian Cai
2021-12-15 14:13   ` Qian Cai
2021-12-15 16:02   ` Catalin Marinas [this message]
2021-12-15 16:02     ` Catalin Marinas
2021-12-15 16:04     ` David Hildenbrand
2021-12-15 16:04       ` David Hildenbrand
2021-12-16  3:00       ` Jianyong Wu
2021-12-16  3:00         ` Jianyong Wu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YboRr0BCgjAbYdHe@arm.com \
    --to=catalin.marinas@arm.com \
    --cc=akpm@linux-foundation.org \
    --cc=anshuman.khandual@arm.com \
    --cc=ardb@kernel.org \
    --cc=david@redhat.com \
    --cc=gshan@redhat.com \
    --cc=jianyong.wu@arm.com \
    --cc=justin.he@arm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nd@arm.com \
    --cc=quic_qiancai@quicinc.com \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.