From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 838C2C433EF for ; Fri, 15 Jul 2022 12:32:46 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9263A9401E8; Fri, 15 Jul 2022 08:32:45 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8D63D9401E5; Fri, 15 Jul 2022 08:32:45 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 79FA19401E8; Fri, 15 Jul 2022 08:32:45 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 6B1639401E5 for ; Fri, 15 Jul 2022 08:32:45 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay12.hostedemail.com (Postfix) with ESMTP id 395881213A0 for ; Fri, 15 Jul 2022 12:32:45 +0000 (UTC) X-FDA: 79689273090.16.409909E Received: from alexa-out-sd-01.qualcomm.com (alexa-out-sd-01.qualcomm.com [199.106.114.38]) by imf31.hostedemail.com (Postfix) with ESMTP id A52E920072 for ; Fri, 15 Jul 2022 12:32:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; i=@quicinc.com; q=dns/txt; s=qcdkim; t=1657888364; x=1689424364; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=GawmyZJSRrTWB3vbdXOQvwH/knbkcC1jFst0zBiD7gY=; b=OjB/Tgmdt7GktSReKExawNvzOy//hvk6LkJtknmA5re+MnB3hoSiXv6B np2fXxkB7PWdu4/51X6SLMtKQzBFgqEKsoRqtKw1C7CZN7z6X/zgPy3aM P8Boh06CplDkYx/MF9xMBTtvbWgfAhlGlqsr7iWJUQiav8VtxVL8ksGeD 8=; Received: from unknown (HELO ironmsg-SD-alpha.qualcomm.com) ([10.53.140.30]) by alexa-out-sd-01.qualcomm.com with ESMTP; 15 Jul 2022 05:32:43 -0700 X-QCInternal: smtphost Received: from nasanex01c.na.qualcomm.com ([10.47.97.222]) by ironmsg-SD-alpha.qualcomm.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Jul 2022 05:32:43 -0700 Received: from nalasex01a.na.qualcomm.com (10.47.209.196) by nasanex01c.na.qualcomm.com (10.47.97.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.22; Fri, 15 Jul 2022 05:32:42 -0700 Received: from [10.216.17.18] (10.80.80.8) by nalasex01a.na.qualcomm.com (10.47.209.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.22; Fri, 15 Jul 2022 05:32:37 -0700 Message-ID: Date: Fri, 15 Jul 2022 18:02:34 +0530 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.9.1 Subject: Re: [PATCH] mm: fix use-after free of page_ext after race with memory-offline Content-Language: en-US To: Andrew Morton CC: , , , , , , , , , , , , Pavan Kondeti References: <1657810063-28938-1-git-send-email-quic_charante@quicinc.com> <20220714180418.6d546650b3e5ae745f09814d@linux-foundation.org> From: Charan Teja Kalla In-Reply-To: <20220714180418.6d546650b3e5ae745f09814d@linux-foundation.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nalasex01a.na.qualcomm.com (10.47.209.196) ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1657888364; a=rsa-sha256; cv=none; b=m/Y8zqT0K1/9yavxrUwya7uBZCNbInVRJGfC4i55SSl+NqG5XzyDTKsG+YdWx3MYA9R2zA b3dTA1AI84+ajnLvZGegdcdolzVm4SKwmzb5XX2Wx3PWWb50BwXCkQ+9ZC4l+DLjNoWOYf PCSAgHUPGuzGpwjIYBvweoKzu6Ea6AA= ARC-Authentication-Results: i=1; imf31.hostedemail.com; dkim=pass header.d=quicinc.com header.s=qcdkim header.b="OjB/Tgmd"; spf=pass (imf31.hostedemail.com: domain of quic_charante@quicinc.com designates 199.106.114.38 as permitted sender) smtp.mailfrom=quic_charante@quicinc.com; dmarc=pass (policy=none) header.from=quicinc.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1657888364; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=GawmyZJSRrTWB3vbdXOQvwH/knbkcC1jFst0zBiD7gY=; b=WKM+fphBX9806HcnSgNbmOf9v+LbKkzEY/zXn0clS/40/wFs1m4yGzBROxfMXTFX29TDte KTpTu8eySfwmatl0ePJOwqjFzwA4k6uGTyz2m1z6Q86hJCKDapkbiDdFG1KA3ck7G9Oaom ELwCtsdIFtMODdl82d8hbqxnNYNU5mc= X-Rspam-User: X-Rspamd-Queue-Id: A52E920072 Authentication-Results: imf31.hostedemail.com; dkim=pass header.d=quicinc.com header.s=qcdkim header.b="OjB/Tgmd"; spf=pass (imf31.hostedemail.com: domain of quic_charante@quicinc.com designates 199.106.114.38 as permitted sender) smtp.mailfrom=quic_charante@quicinc.com; dmarc=pass (policy=none) header.from=quicinc.com X-Rspamd-Server: rspam04 X-Stat-Signature: 49hbgm7ynso5kaymfw4xzbaq4gtbuft9 X-HE-Tag: 1657888364-578878 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Thanks Andrew for the review!! On 7/15/2022 6:34 AM, Andrew Morton wrote: > On Thu, 14 Jul 2022 20:17:43 +0530 Charan Teja Kalla wrote: > >> The below is one path where race between page_ext and offline of the >> respective memory blocks will cause use-after-free on the access of >> page_ext structure. >> >> ... >> >> --- a/include/linux/page_ext.h >> +++ b/include/linux/page_ext.h >> @@ -64,6 +64,25 @@ static inline struct page_ext *page_ext_next(struct page_ext *curr) >> return next; >> } >> >> +static inline struct page_ext *get_page_ext(struct page *page) >> +{ >> + struct page_ext *page_ext; >> + >> + rcu_read_lock(); > If page_ext.h is to call rcu functions then it will need to include > appropriate header files. > Will add them!! >> + page_ext = lookup_page_ext(page); >> + if (!page_ext) { >> + rcu_read_unlock(); >> + return NULL; >> + } >> + >> + return page_ext; >> +} >> + >> +static inline void put_page_ext(void) >> +{ >> + rcu_read_unlock(); >> +} > Better names would be page_ext_get() and page_ext_put(). The rest of > the page_ext API appears to have got this right, so let's not mess that > up. I see naming convention is not consistent in page_ext.c. For couple of them I see page_ext_xxx() and for the rest it is xxx_page_ext(). Sure I will follow the page_ext_xxx() convention in V2. > > Also, these aren't really get and put functions - page_ext doesn't have > a refcount. But I can't immediately think of a name that better > communicates what we're doing here so I guess get and put will do. >> And are we able to add some comments here explaining why these > functions exist and what they do? Sure will add then in V2. > >> #else /* !CONFIG_PAGE_EXTENSION */ >> struct page_ext; > Are you sure we didn't need CONFIG_PAGE_EXTENSION=n stubs for these two > functions? I think it does need. Will add them in v2. > >