From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF4EAC636D3 for ; Thu, 9 Feb 2023 18:46:49 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3BADD6B0071; Thu, 9 Feb 2023 13:46:49 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 36B4C6B0072; Thu, 9 Feb 2023 13:46:49 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 259436B0074; Thu, 9 Feb 2023 13:46:49 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 1564C6B0071 for ; Thu, 9 Feb 2023 13:46:49 -0500 (EST) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id D95BA160F8A for ; Thu, 9 Feb 2023 18:46:48 +0000 (UTC) X-FDA: 80448634896.19.7C6CB87 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf01.hostedemail.com (Postfix) with ESMTP id 1F1AD40007 for ; Thu, 9 Feb 2023 18:46:46 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=gEBA8p5f; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf01.hostedemail.com: domain of ebiggers@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=ebiggers@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1675968407; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=zr3VgWCw5hIKltPPUyQ6d6volHAycGP/RlADkfviPXE=; b=Muo2W79rGgoS34Lh8JMbFCwWqlwvNjFqDnZIeWhAPX66M0OuMGcrHGIMpnmsbe8bXZsaEu cZqIqLK6ce22sjqSwgIJBmTrjl/0LmOWNwRLgEca4ZJyX0zKnZzMpTMBkwE1CBG4hNx+6A qh/shdgvLLWnSYEI3X1hwndNBDcPLXs= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=gEBA8p5f; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf01.hostedemail.com: domain of ebiggers@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=ebiggers@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1675968407; a=rsa-sha256; cv=none; b=WmuLorgmVs9XkXq9n1ujcJlK7Y4sXFrOPw4WvggKXqz0tD6PzweCczrb8+XfCk/bXksZvG QeVflk9Lv85PYlKOsrJ/MVt7Scrul/xxkL9PG1avF2FY9Y7Oyelkc4f3H0T8PlehzTz3x1 YibZXEy8/J6CFrsr7WzSN3949hh3yME= Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0C73461B8D; Thu, 9 Feb 2023 18:46:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 531B1C433D2; Thu, 9 Feb 2023 18:46:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1675968405; bh=NA3iBMWRcwiWdDAwavupXMF3yWhQzTQj/BEcxQTPM/Q=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=gEBA8p5f1drrwalcpKiwz5P6rKDdKFoNX8y+rW0INdsnt8ucIy+YhSmp5RCVU9ZHV 452qi9hbX0cxpvblbJ7sg/ihkJkUNKZ3z2vez8Et2PUXeiCB9TPVO6cDBnoZ8nx4By rJo3QmhTOXh6HPbtQglP6pTkfKjAPZX9k8xdWdGB7kmUbWmDVQDE12HGT2tzUPgJ8B S1ISc1VTJHedYKKI1IBXcfHEjIL9tRa748yllU+ywDbebz737Rd8PNWkPj/nE38DaT SBJXGE9F7crNYXg80bBD4yb9ABdb+vI1OJqyCCpPf/Nc5BvZUvA31pE3KZn8s9KO3x fwDJJqM/SV4oA== Date: Thu, 9 Feb 2023 18:46:43 +0000 From: Eric Biggers To: Suren Baghdasaryan Cc: Munehisa Kamata , hannes@cmpxchg.org, hdanton@sina.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mengcc@amazon.com, stable@vger.kernel.org Subject: Re: [PATCH] sched/psi: fix use-after-free in ep_remove_wait_queue() Message-ID: References: <20230202030023.1847084-1-kamatam@amazon.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 1F1AD40007 X-Stat-Signature: rxkboefhjmgdt68ofabmxnq5no1jxc9d X-HE-Tag: 1675968406-189503 X-HE-Meta: U2FsdGVkX1/zW/BRbpJvCBz7NezEqnRD22fitLfZ7ITmk1N82N3tDVLaZA9Sol5MeuqdCUtPWbsHHbYYHXM/7bjN/AF/lKjJp8sE6GbZooSZ7e1U8+5RIU+xsa53O0Tg9PxyWWFNkwBiEANt+nh4gkOfTu8EGlh0F6fMw62wKUTQR8CUIssvLmGK0XjE7qrs0/Su6l6F+pHvQhkxpqBkIVfPnOGuRrttn69kulxmiXaTkekXRWPh1hlPe1TwKoYcgxwRXBHDGQ2ClUgC/0WhqngvxhFNfvHAkI0D9+cWGJDCbbUTn+nUE+AKbiSgRK2mHIIegy7efHNziozo4O4koYKOiBN+6DmVslQEEy1bBioVfRLbLyE/HOMu7qJs8xXIVnXhdM9cR2LW/yl7t9PrKhpgCiL1iYnpjMwJtEt9cHlBfN8opR4kRY3gswfe1t/aZqCxc884JS368iAnxoMCwMtcEtV3QlsclCl6u+rFMy+h/aXBRZ0nZ5exEPCFMM5ZUvSJ9qDqleN9Ntv2Xc9TSEyFE3cfHXUXgypEen77MIySru8sbgI137DyDlMvFfGkG2SJpfs4pcAeNwfxMjovmM3Npm0yrRfLjrCsFEsDpqPbY0RY0313YRUMTKaT1sHqpn8LDHuHk6sG8nNndeJn9yDfmjYW+U0ir8hz4J+xFqwEojmx4c5s0eHW+dlbyTp/GCTnvBAT0nHXnqV19limytobuNCvXF9smckIvfI1dqUe48F75VzDxpX43tXo1YaQvcQHm8A9fc5Y23wn3pF3dai/ZrGd3a651CpWNYHb8vFl0sb0NX1pvMduUQYVakMV9im0SrHx25nL0YeT7PrmVQpAuWfngVJ9lR+zhDJJWurgeCJhSXtVNCBLoEdjcD+VPPKjmM922aQxAz6a1pqmPMtVAPYxOioqHhQS3LXZFynRNoKDLWLr6E3wW8RekiWeC1PY3GnOoCo9+8aysiZ wbk0c34B NR8uDPPOEqhclVbOlYGgPLhr9TZLSeY1dmTGYHSJvAYPFkYolVyUB20dUnNMMoS8gcFSHXRgApOWSxeO0AHTwijVs1sl1WR9L9G1MRFr1Lovbc8Txv6EdEJgmfFUHA3LLH+II/gSXQgtq71EcgHmRZjCknRlpOlkwLj1/rZyzfirapx0N2U78qlP9LFYrUEgLd0ppjsHCrh70GOSfzHQzw3Aaaz8p33qkouG4z4aBkM81U7aOFOOEnmjfaIRh3uWphATgHmmpmGlm1/nhOW2dPb/G6IzHTP6UZ2d/Mdfw2rj7DhzV6bnyssEOTm8Kg0y3ErO0P4Fn1IezLOWJ/cLno23PwU6op+hxWY8dm/fOnsxbZJZYOqqXAfdk3xvJ97G+yRNmLAaz3rNgx12STFAeRjBKIHRy92wcW0W2 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Feb 09, 2023 at 09:09:03AM -0800, Suren Baghdasaryan wrote: > On Thu, Feb 2, 2023 at 1:11 PM Suren Baghdasaryan wrote: > > > > On Wed, Feb 1, 2023 at 8:56 PM Eric Biggers wrote: > > > > > > On Wed, Feb 01, 2023 at 07:00:23PM -0800, Munehisa Kamata wrote: > > > > diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c > > > > index 8ac8b81bfee6..6e66c15f6450 100644 > > > > --- a/kernel/sched/psi.c > > > > +++ b/kernel/sched/psi.c > > > > @@ -1343,10 +1343,11 @@ void psi_trigger_destroy(struct psi_trigger *t) > > > > > > > > group = t->group; > > > > /* > > > > - * Wakeup waiters to stop polling. Can happen if cgroup is deleted > > > > - * from under a polling process. > > > > + * Wakeup waiters to stop polling and clear the queue to prevent it from > > > > + * being accessed later. Can happen if cgroup is deleted from under a > > > > + * polling process otherwise. > > > > */ > > > > - wake_up_interruptible(&t->event_wait); > > > > + wake_up_pollfree(&t->event_wait); > > > > > > > > mutex_lock(&group->trigger_lock); > > > > > > wake_up_pollfree() should only be used in extremely rare cases. Why can't the > > > lifetime of the waitqueue be fixed instead? > > > > waitqueue lifetime in this case is linked to cgroup_file_release(), > > which seems appropriate to me here. Unfortunately > > cgroup_file_release() is not directly linked to the file's lifetime. > > For more details see: > > https://lore.kernel.org/all/CAJuCfpFZ3B4530TgsSHqp5F_gwfrDujwRYewKReJru==MdEHQg@mail.gmail.com/#t > > . > > So, if we want to fix the lifetime of the waitqueue, we would have to > > tie cgroup_file_release() to the fput() somehow. IOW, the fix would > > have to be done at the cgroups or higher (kernfs?) layer. > > Hi Eric, > Do you still object to using wake_up_pollfree() for this case? > Changing higher levels to make cgroup_file_release() be tied to fput() > would be ideal but I think that would be a big change for this one > case. If you agree I'll Ack this patch. > Thanks, > Suren. > I haven't read the code closely in this case. I'm just letting you know that wake_up_pollfree() is very much a last-resort option for when the waitqueue lifetime can't be fixed. So if you want to use wake_up_pollfree(), you need to explain why no other fix is possible. For example maybe the UAPI depends on the waitqueue having a nonstandard lifetime. - Eric