* [Question] Is there a race window between __anon_vma_prepare() with page_lock_anon_vma_read() ?
@ 2021-05-14 9:16 Miaohe Lin
2021-05-19 8:41 ` Miaohe Lin
0 siblings, 1 reply; 2+ messages in thread
From: Miaohe Lin @ 2021-05-14 9:16 UTC (permalink / raw)
To: Linux-MM, linux-kernel; +Cc: Andrew Morton
Hi all,
I am investigating the rmap code, and I found the below possible race window:
CPU 1 CPU 2
----- -----
page_lock_anon_vma_read
rcu_read_lock
/* We assume anon_vam == root_anon_vma in this case. */
root_anon_vma = READ_ONCE(anon_vma->root);
root_anon_vma is *released* somewhere unfortunately.
down_read_trylock(&root_anon_vma->rwsem)
__anon_vma_prepare
anon_vma_alloc
root_anon_vma is *allocated* here.
init_rwsem(&anon_vma->rwsem);
!page_mapped(page)
up_read(&root_anon_vma->rwsem); -- *Oops!*
root_anon_vma->rwsem is reinitialized after locked. And reinitialized anon_vma->rwsem will be
unlocked without lock first.
I think this could happen due to the subtle SLAB_TYPESAFE_BY_RCU. But only can occur when anon_vma
is root anon_vma or they won't operate on the same rwsem.
Is this will really happen or Am I miss something ? Any reply would be very grateful.
Many Thanks! :)
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [Question] Is there a race window between __anon_vma_prepare() with page_lock_anon_vma_read() ?
2021-05-14 9:16 [Question] Is there a race window between __anon_vma_prepare() with page_lock_anon_vma_read() ? Miaohe Lin
@ 2021-05-19 8:41 ` Miaohe Lin
0 siblings, 0 replies; 2+ messages in thread
From: Miaohe Lin @ 2021-05-19 8:41 UTC (permalink / raw)
To: Linux-MM, linux-kernel; +Cc: Andrew Morton
On 2021/5/14 17:16, Miaohe Lin wrote:
> Hi all,
> I am investigating the rmap code, and I found the below possible race window:
>
> CPU 1 CPU 2
> ----- -----
> page_lock_anon_vma_read
> rcu_read_lock
> /* We assume anon_vam == root_anon_vma in this case. */
> root_anon_vma = READ_ONCE(anon_vma->root);
> root_anon_vma is *released* somewhere unfortunately.
> down_read_trylock(&root_anon_vma->rwsem)
> __anon_vma_prepare
> anon_vma_alloc
> root_anon_vma is *allocated* here.
> init_rwsem(&anon_vma->rwsem);
> !page_mapped(page)
> up_read(&root_anon_vma->rwsem); -- *Oops!*
>
> root_anon_vma->rwsem is reinitialized after locked. And reinitialized anon_vma->rwsem will be
> unlocked without lock first.
>
> I think this could happen due to the subtle SLAB_TYPESAFE_BY_RCU. But only can occur when anon_vma
> is root anon_vma or they won't operate on the same rwsem.
> Is this will really happen or Am I miss something ? Any reply would be very grateful.
> Many Thanks! :)
Any reply would be very grateful.
Many thanks!
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-19 8:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-14 9:16 [Question] Is there a race window between __anon_vma_prepare() with page_lock_anon_vma_read() ? Miaohe Lin
2021-05-19 8:41 ` Miaohe Lin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.