linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Michael S. Tsirkin" <mst@redhat.com>
To: Jason Wang <jasowang@redhat.com>
Cc: kvm@vger.kernel.org, virtualization@lists.linux-foundation.org,
	netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 6/6] vhost: don't do synchronize_rcu() in vhost_uninit_vq_maps()
Date: Tue, 23 Jul 2019 05:16:45 -0400	[thread overview]
Message-ID: <20190723041144-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <20190723075718.6275-7-jasowang@redhat.com>

On Tue, Jul 23, 2019 at 03:57:18AM -0400, Jason Wang wrote:
> There's no need for RCU synchronization in vhost_uninit_vq_maps()
> since we've already serialized with readers (memory accessors). This
> also avoid the possible userspace DOS through ioctl() because of the
> possible high latency caused by synchronize_rcu().
> 
> Reported-by: Michael S. Tsirkin <mst@redhat.com>
> Fixes: 7f466032dc9e ("vhost: access vq metadata through kernel virtual address")
> Signed-off-by: Jason Wang <jasowang@redhat.com>

I agree synchronize_rcu in both mmu notifiers and ioctl
is a problem we must fix.

> ---
>  drivers/vhost/vhost.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index 5b8821d00fe4..a17df1f4069a 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -334,7 +334,9 @@ static void vhost_uninit_vq_maps(struct vhost_virtqueue *vq)
>  	}
>  	spin_unlock(&vq->mmu_lock);
>  
> -	synchronize_rcu();
> +	/* No need for synchronize_rcu() or kfree_rcu() since we are
> +	 * serialized with memory accessors (e.g vq mutex held).
> +	 */
>  
>  	for (i = 0; i < VHOST_NUM_ADDRS; i++)
>  		if (map[i])
> -- 
> 2.18.1

.. however we can not RCU with no synchronization in sight.
Sometimes there are hacks like using a lock/unlock
pair instead of sync, but here no one bothers.

specifically notifiers call reset vq maps which calls
uninit vq maps which is not under any lock.

You will get use after free when map is then accessed.

If you always have a lock then just take that lock
and no need for RCU.

-- 
MST

  reply	other threads:[~2019-07-23  9:16 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-23  7:57 [PATCH 0/6] Fixes for meta data acceleration Jason Wang
2019-07-23  7:57 ` [PATCH 1/6] vhost: don't set uaddr for invalid address Jason Wang
2019-07-23  7:57 ` [PATCH 2/6] vhost: validate MMU notifier registration Jason Wang
2019-07-23  9:17   ` Michael S. Tsirkin
2019-07-23 13:30     ` Jason Wang
2019-07-23  7:57 ` [PATCH 3/6] vhost: fix vhost map leak Jason Wang
2019-07-23  7:57 ` [PATCH 4/6] vhost: reset invalidate_count in vhost_set_vring_num_addr() Jason Wang
2019-07-23  9:17   ` Michael S. Tsirkin
2019-07-23 13:25     ` Jason Wang
2019-07-23  7:57 ` [PATCH 5/6] vhost: mark dirty pages during map uninit Jason Wang
2019-07-23  9:17   ` Michael S. Tsirkin
2019-07-23 13:19     ` Jason Wang
2019-07-25  5:21       ` Michael S. Tsirkin
2019-07-23  7:57 ` [PATCH 6/6] vhost: don't do synchronize_rcu() in vhost_uninit_vq_maps() Jason Wang
2019-07-23  9:16   ` Michael S. Tsirkin [this message]
2019-07-23 13:16     ` Jason Wang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190723041144-mutt-send-email-mst@kernel.org \
    --to=mst@redhat.com \
    --cc=jasowang@redhat.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=virtualization@lists.linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).