From: "Luis R. Rodriguez" <mcgrof@kernel.org>
To: Petr Mladek <pmladek@suse.com>, Peter Zijlstra <peterz@infradead.org>
Cc: "Luis R. Rodriguez" <mcgrof@kernel.org>,
shuah@kernel.org, jeyu@redhat.com, rusty@rustcorp.com.au,
ebiederm@xmission.com, dmitry.torokhov@gmail.com,
acme@redhat.com, corbet@lwn.net, martin.wilck@suse.com,
mmarek@suse.com, hare@suse.com, rwright@hpe.com, jeffm@suse.com,
DSterba@suse.com, fdmanana@suse.com, neilb@suse.com,
linux@roeck-us.net, rgoldwyn@suse.com, subashab@codeaurora.org,
xypron.glpk@gmx.de, keescook@chromium.org, atomlin@redhat.com,
mbenes@suse.cz, paulmck@linux.vnet.ibm.com,
dan.j.williams@intel.com, jpoimboe@redhat.com,
davem@davemloft.net, mingo@redhat.com, akpm@linux-foundation.org,
torvalds@linux-foundation.org, linux-kselftest@vger.kernel.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [RFC 06/10] kmod: provide sanity check on kmod_concurrent access
Date: Tue, 10 Jan 2017 21:00:08 +0100 [thread overview]
Message-ID: <20170110200008.GI13946@wotan.suse.de> (raw)
In-Reply-To: <20161215125747.GB14324@pathway.suse.cz>
On Thu, Dec 15, 2016 at 01:57:48PM +0100, Petr Mladek wrote:
> On Thu 2016-12-08 11:48:50, Luis R. Rodriguez wrote:
> > Only decrement *iff* we're possitive. Warn if we've hit
> > a situation where the counter is already 0 after we're done
> > with a modprobe call, this would tell us we have an unaccounted
> > counter access -- this in theory should not be possible as
> > only one routine controls the counter, however preemption is
> > one case that could trigger this situation. Avoid that situation
> > by disabling preemptiong while we access the counter.
> >
> > Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
> > ---
> > kernel/kmod.c | 20 ++++++++++++++++----
> > 1 file changed, 16 insertions(+), 4 deletions(-)
> >
> > diff --git a/kernel/kmod.c b/kernel/kmod.c
> > index ab38539f7e91..09cf35a2075a 100644
> > --- a/kernel/kmod.c
> > +++ b/kernel/kmod.c
> > @@ -113,16 +113,28 @@ static int call_modprobe(char *module_name, int wait)
> >
> > static int kmod_umh_threads_get(void)
> > {
> > + int ret = 0;
> > +
> > + preempt_disable();
> > atomic_inc(&kmod_concurrent);
> > if (atomic_read(&kmod_concurrent) < max_modprobes)
> > - return 0;
> > - atomic_dec(&kmod_concurrent);
> > - return -EBUSY;
> > + goto out;
>
> I though more about it and the disabled preemtion might make
> sense here. It makes sure that we are not rescheduled here
> and that kmod_concurrent is not increased by mistake for too long.
I think its good to add a comment here about this.
> Well, it still would make sense to increment the value
> only when it is under the limit and set the incremented
> value using cmpxchg to avoid races.
>
> I mean to use similar trick that is used by refcount_inc(), see
> https://lkml.kernel.org/r/20161114174446.832175072@infradead.org
Right, I see now. Since we are converting this to kref though we would
immediately get the advantages of kref_get() using the new refcount_inc() once
that goes in, so I think its best we just sit tight to get that benefit given
as Jessica acknowledged the existing code has has this issue for ages, waiting
a bit longer should not hurt. The preemption should help in the meantime as
well.
The note I've made then is:
/*
* Disabling preemption makes sure that we are not rescheduled here.
*
* Also preemption helps kmod_concurrent is not increased by mistake
* for too long given in theory two concurrent threads could race on
* kref_get() before we kref_read().
*
* XXX: once Peter's refcount_t gets merged kref's kref_get() will use
* the new refcount_inc() and then each inc will be atomic with respect
* to each thread, as such when Peter's refcount_t gets merged
* the above comment "Also preemption ..." can be removed.
*/
Come to think of it, once Peter's changes go in at first glance it may seem
preemption would be pointless then but but I think that just mitigates a few
of the refcount_inc() instances where (old != val), that is -- when two threads
got the same bump, so think it can be kept even after Peter's refcount_t work.
> > + atomic_dec_if_positive(&kmod_concurrent);
> > + ret = -EBUSY;
> > +out:
> > + preempt_enable();
> > + return 0;
> > }
> >
> > static void kmod_umh_threads_put(void)
> > {
> > - atomic_dec(&kmod_concurrent);
> > + int ret;
> > +
> > + preempt_disable();
> > + ret = atomic_dec_if_positive(&kmod_concurrent);
> > + WARN_ON(ret < 0);
> > + preempt_enable();
>
> The disabled preemption does not make much sense here.
> We do not need to tie the atomic operation and the WARN
> together so tightly.
Makes sense, will add a note.
kref also lacks such a mnemonic as atomic_dec_if_positive()
and since I've now converted this to kref I've dropped this.
Luis
next prev parent reply other threads:[~2017-01-10 20:01 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-08 18:47 [RFC 00/10] kmod: stress test driver, few fixes and enhancements Luis R. Rodriguez
2016-12-08 18:47 ` [RFC 01/10] kmod: add test driver to stress test the module loader Luis R. Rodriguez
2016-12-08 20:24 ` Kees Cook
2016-12-13 21:10 ` Luis R. Rodriguez
2016-12-16 7:41 ` Luis R. Rodriguez
2016-12-08 19:48 ` [RFC 02/10] module: fix memory leak on early load_module() failures Luis R. Rodriguez
2016-12-08 20:30 ` Kees Cook
2016-12-08 21:10 ` Luis R. Rodriguez
2016-12-08 21:17 ` Kees Cook
2016-12-09 17:06 ` Miroslav Benes
2016-12-16 8:51 ` Luis R. Rodriguez
2016-12-15 18:46 ` Aaron Tomlin
2016-12-08 19:48 ` [RFC 03/10] kmod: add dynamic max concurrent thread count Luis R. Rodriguez
2016-12-08 20:28 ` Kees Cook
2016-12-08 21:00 ` Luis R. Rodriguez
2016-12-14 15:38 ` Petr Mladek
2016-12-16 8:39 ` Luis R. Rodriguez
2017-01-10 19:24 ` Luis R. Rodriguez
2016-12-08 19:48 ` [RFC 04/10] kmod: provide wrappers for kmod_concurrent inc/dec Luis R. Rodriguez
2016-12-08 20:29 ` Kees Cook
2016-12-08 21:08 ` Luis R. Rodriguez
2016-12-15 12:46 ` Petr Mladek
2016-12-16 8:05 ` Luis R. Rodriguez
2016-12-22 4:48 ` Jessica Yu
2017-01-06 20:54 ` Luis R. Rodriguez
2017-01-10 18:57 ` [RFC 04/10] " Luis R. Rodriguez
2017-01-11 20:08 ` Luis R. Rodriguez
2017-05-16 18:02 ` Luis R. Rodriguez
2017-05-18 2:37 ` Luis R. Rodriguez
2016-12-22 5:07 ` Jessica Yu
2017-01-10 20:28 ` Luis R. Rodriguez
2016-12-08 19:48 ` [RFC 05/10] kmod: return -EBUSY if modprobe limit is reached Luis R. Rodriguez
2016-12-08 19:48 ` [RFC 06/10] kmod: provide sanity check on kmod_concurrent access Luis R. Rodriguez
2016-12-14 16:08 ` Petr Mladek
2016-12-14 17:12 ` Luis R. Rodriguez
2016-12-15 12:57 ` Petr Mladek
2017-01-10 20:00 ` Luis R. Rodriguez [this message]
2016-12-08 19:49 ` [RFC 07/10] kmod: use simplified rate limit printk Luis R. Rodriguez
2016-12-14 16:23 ` Petr Mladek
2016-12-14 16:41 ` Joe Perches
2016-12-16 8:44 ` Luis R. Rodriguez
2016-12-08 19:49 ` [RFC 08/10] sysctl: add support for unsigned int properly Luis R. Rodriguez
2016-12-08 19:49 ` [RFC 09/10] kmod: add helpers for getting kmod count and limit Luis R. Rodriguez
2016-12-15 16:56 ` Petr Mladek
2016-12-16 7:57 ` Luis R. Rodriguez
2017-01-11 18:27 ` Luis R. Rodriguez
2016-12-08 19:49 ` [RFC 10/10] kmod: add a sanity check on module loading Luis R. Rodriguez
2016-12-09 20:03 ` Martin Wilck
2016-12-09 20:56 ` Linus Torvalds
2016-12-15 18:08 ` Luis R. Rodriguez
2016-12-15 0:27 ` Rusty Russell
2016-12-16 8:31 ` Luis R. Rodriguez
2016-12-17 3:54 ` Rusty Russell
[not found] ` <CAB=NE6VvuA9a6hf6yoopGfUxVJQM5HyV5bNzUdsEtUV0UhbG-g@mail.gmail.com>
2016-12-20 0:53 ` Rusty Russell
2016-12-20 18:52 ` Luis R. Rodriguez
2016-12-21 2:21 ` Rusty Russell
2016-12-21 13:08 ` Luis R. Rodriguez
2017-01-03 0:04 ` Rusty Russell
2017-01-06 20:36 ` Luis R. Rodriguez
2017-01-06 21:53 ` Jessica Yu
2017-01-09 20:27 ` Luis R. Rodriguez
[not found] ` <87bmvgax51.fsf@rustcorp.com.au>
2017-01-09 19:56 ` [RFC 10/10] " Luis R. Rodriguez
2017-01-06 21:03 ` Jessica Yu
2017-01-04 2:47 ` Jessica Yu
2017-01-11 19:10 ` [RFC 00/10] kmod: stress test driver, few fixes and enhancements Luis R. Rodriguez
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170110200008.GI13946@wotan.suse.de \
--to=mcgrof@kernel.org \
--cc=DSterba@suse.com \
--cc=acme@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=atomlin@redhat.com \
--cc=corbet@lwn.net \
--cc=dan.j.williams@intel.com \
--cc=davem@davemloft.net \
--cc=dmitry.torokhov@gmail.com \
--cc=ebiederm@xmission.com \
--cc=fdmanana@suse.com \
--cc=hare@suse.com \
--cc=jeffm@suse.com \
--cc=jeyu@redhat.com \
--cc=jpoimboe@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=martin.wilck@suse.com \
--cc=mbenes@suse.cz \
--cc=mingo@redhat.com \
--cc=mmarek@suse.com \
--cc=neilb@suse.com \
--cc=paulmck@linux.vnet.ibm.com \
--cc=peterz@infradead.org \
--cc=pmladek@suse.com \
--cc=rgoldwyn@suse.com \
--cc=rusty@rustcorp.com.au \
--cc=rwright@hpe.com \
--cc=shuah@kernel.org \
--cc=subashab@codeaurora.org \
--cc=torvalds@linux-foundation.org \
--cc=xypron.glpk@gmx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).