From: Jesper Dangaard Brouer <brouer@redhat.com>
To: "Jonathan Lemon" <jonathan.lemon@gmail.com>
Cc: "Alexei Starovoitov" <ast@fb.com>,
netdev@vger.kernel.org, davem@davemloft.net,
"Kernel Team" <Kernel-team@fb.com>,
ilias.apalodimas@linaro.org, brouer@redhat.com
Subject: Re: [net-next PATCH] page_pool: do not release pool until inflight == 0.
Date: Wed, 13 Nov 2019 11:08:23 +0100 [thread overview]
Message-ID: <20191113110823.0e1186a5@carbon> (raw)
In-Reply-To: <04EECB84-2958-4D59-BE2D-FD7ABD8E4C05@gmail.com>
On Tue, 12 Nov 2019 09:32:10 -0800
"Jonathan Lemon" <jonathan.lemon@gmail.com> wrote:
> On 12 Nov 2019, at 9:23, Alexei Starovoitov wrote:
>
> > On 11/12/19 8:48 AM, Jesper Dangaard Brouer wrote:
> >>> The trace_page_pool_state_release() does not dereference pool, it
> >>> just
> >>> reports the pointer value, so there shouldn't be any use-after-free.
> >> In the tracepoint we can still dereference the pool object pointer.
> >> This is made easier via using bpftrace for example see[1] (and with
> >> BTF
> >> this will become more common to do so).
> >
> > bpf tracing progs cannot assume that the pointer is valid.
> > The program can remember a kernel pointer in a map and then
> > access it days later.
> > Like kretprobe on kfree_skb(). The skb is freed. 100% use-after-free.
> > Such bpf program is broken and won't be reading meaningful values,
> > but it won't crash the kernel.
> >
> > On the other side we should not be passing pointers to freed objects
> > into tracepoints. That just wrong.
> > May be simply move that questionable tracepoint?
>
> Yes, move and simplify it. I believe this patch should resolve the
> issue, it just reports pages entering/exiting the pool, without
> trying to access the counters - the counters are reported through the
> inflight tracepoint.
Sorry, I don't like loosing the counter. I have a plan for using these
counters in a bpftrace script. (Worst case I might be able to live
without the counters).
The basic idea is to use these tracepoints to detect if we leak
DMA-mappings. I'll try write the bpftrace script today, and
see it I can live without the counter.
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
next prev parent reply other threads:[~2019-11-13 10:08 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-12 5:32 [net-next PATCH] page_pool: do not release pool until inflight == 0 Jonathan Lemon
2019-11-12 12:08 ` Jesper Dangaard Brouer
2019-11-12 16:33 ` Jonathan Lemon
2019-11-12 16:48 ` Jesper Dangaard Brouer
2019-11-12 17:14 ` Jonathan Lemon
2019-11-12 17:23 ` Alexei Starovoitov
2019-11-12 17:32 ` Jonathan Lemon
2019-11-13 10:08 ` Jesper Dangaard Brouer [this message]
2019-11-13 16:37 ` Jesper Dangaard Brouer
2019-11-12 15:11 ` Jesper Dangaard Brouer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191113110823.0e1186a5@carbon \
--to=brouer@redhat.com \
--cc=Kernel-team@fb.com \
--cc=ast@fb.com \
--cc=davem@davemloft.net \
--cc=ilias.apalodimas@linaro.org \
--cc=jonathan.lemon@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).