From: Dave Hansen <dave@linux.vnet.ibm.com>
To: Christoph Lameter <cl@linux.com>
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
"Eric W. Biederman" <ebiederm@xmission.com>
Subject: Re: [RFC][PATCH] fix move/migrate_pages() race on task struct
Date: Thu, 23 Feb 2012 12:04:23 -0800 [thread overview]
Message-ID: <4F469BC7.50705@linux.vnet.ibm.com> (raw)
In-Reply-To: <alpine.DEB.2.00.1202231334290.10914@router.home>
On 02/23/2012 11:40 AM, Christoph Lameter wrote:
> On Thu, 23 Feb 2012, Dave Hansen wrote:
>>> Hmmm isnt the race still there between the determination of the task and
>>> the get_task_struct()? You would have to verify after the get_task_struct
>>> that this is really the task we wanted to avoid the race.
>>
>> It's true that selecting a task by pid is inherently racy. What that
>> code does is ensure that the task you've got current has 'pid', but not
>> ensure that 'pid' has never represented another task. But, that's what
>> we do everywhere else in the kernel; there's not much better that we can do.
>
> We may at this point be getting a reference to a task struct from another
> process not only from the current process (where the above procedure is
> valid). You rightly pointed out that the slab rcu free mechanism allows a
> free and a reallocation within the RCU period.
I didn't _mean_ to point that out, but I think I realize what you're
talking about. What we have before this patch is this:
rcu_read_lock();
task = pid ? find_task_by_vpid(pid) : current;
rcu_read_unlock();
task->foo;
So, the task at task->foo time is neither RCU-protected nor protected by
having a reference. I changed it to:
rcu_read_lock();
task = pid ? find_task_by_vpid(pid) : current;
get_task_struct(task);
rcu_read_unlock();
task->foo;
That keeps task from being freed. But, as you point out
> The effect is that the task
> struct could be pointing to a task with another pid that what we were
> looking for and therefore migrate_pages could subsequently be operating on
> a totally different process.
>
> The patch does not fix that race so far.
Agreed, this patch would not fix such an issue.
I think this also implies that stuff like get_task_pid() is broken,
along with virtually all of the users of find_task_by_vpid(). Eric, any
thoughts on this?
> I think you have to verify that the pid of the task matches after you took
> the refcount in order to be safe. If it does not match then abort.
>
>> Maybe "race" is the wrong word for what we've got here. It's a lack of
>> a refcount being taken.
>
> Is that a real difference or are you just playing with words?
I think we're talking about two different things:
1. does RCU protect the pid->task lookup sufficiently?
2. Can the task simply go away in the move/migrate_pages() calls?
I think we're on the same page now.
next prev parent reply other threads:[~2012-02-23 20:04 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-23 18:07 [RFC][PATCH] fix move/migrate_pages() race on task struct Dave Hansen
2012-02-23 18:45 ` Andi Kleen
2012-02-23 18:45 ` Christoph Lameter
2012-02-23 19:10 ` Dave Hansen
2012-02-23 19:40 ` Christoph Lameter
2012-02-23 20:04 ` Dave Hansen [this message]
2012-02-23 21:41 ` Christoph Lameter
2012-02-24 3:14 ` Eric W. Biederman
2012-02-24 15:20 ` Christoph Lameter
2012-02-24 15:41 ` Eric W. Biederman
2012-02-24 16:48 ` Dave Hansen
2012-02-24 16:54 ` Christoph Lameter
2012-02-24 17:04 ` Dave Hansen
2012-02-24 17:08 ` Christoph Lameter
2012-02-24 17:25 ` Dave Hansen
2012-02-24 17:32 ` Christoph Lameter
2012-02-24 21:37 ` Dave Hansen
2012-02-24 23:12 ` Eric W. Biederman
2012-02-27 16:43 ` Christoph Lameter
2012-02-25 12:13 ` Eric W. Biederman
2012-02-27 19:01 ` Christoph Lameter
2012-02-27 20:15 ` Eric W. Biederman
2012-02-27 22:39 ` Christoph Lameter
2012-02-28 19:30 ` Christoph Lameter
2012-02-29 20:31 ` Andrew Morton
2012-02-29 20:33 ` Christoph Lameter
2012-02-29 20:36 ` Dave Hansen
2012-02-24 17:07 ` KOSAKI Motohiro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F469BC7.50705@linux.vnet.ibm.com \
--to=dave@linux.vnet.ibm.com \
--cc=cl@linux.com \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).