From: Dmitry Vyukov <dvyukov@google.com>
To: Florian Westphal <fw@strlen.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Christoph Lameter <cl@linux.com>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
"Theodore Ts'o" <tytso@mit.edu>, Jan Kara <jack@suse.com>,
linux-ext4@vger.kernel.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
David Miller <davem@davemloft.net>,
NetFilter <netfilter-devel@vger.kernel.org>,
coreteam@netfilter.org,
Network Development <netdev@vger.kernel.org>,
Gerrit Renker <gerrit@erg.abdn.ac.uk>,
dccp@vger.kernel.org, Jani Nikula <jani.nikula@linux.intel.com>,
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>,
Rodrigo Vivi <rodrigo.vivi@intel.com>,
Dave Airlie <airlied@linux.ie>,
intel-gfx <intel-gfx@lists.freedesktop.org>,
DRI <dri-devel@lists.freedesktop.org>,
Eric Dumazet <edumazet@google.com>,
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
Ursula Braun <ubraun@linux.ibm.com>,
linux-s390 <linux-s390@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
linux-mm <linux-mm@kvack.org>,
Andrey Konovalov <andreyknvl@google.com>
Subject: Re: SLAB_TYPESAFE_BY_RCU without constructors (was Re: [PATCH v4 13/17] khwasan: add hooks implementation)
Date: Wed, 1 Aug 2018 12:41:09 +0200 [thread overview]
Message-ID: <CACT4Y+aHWpgDZygXv=smWwdVMWfjpedyajuVvvLDGMK-wFD5Lw@mail.gmail.com> (raw)
In-Reply-To: <20180801103537.d36t3snzulyuge7g@breakpoint.cc>
On Wed, Aug 1, 2018 at 12:35 PM, Florian Westphal <fw@strlen.de> wrote:
> Dmitry Vyukov <dvyukov@google.com> wrote:
>> Still can't grasp all details.
>> There is state that we read without taking ct->ct_general.use ref
>> first, namely ct->state and what's used by nf_ct_key_equal.
>> So let's say the entry we want to find is in the list, but
>> ____nf_conntrack_find finds a wrong entry earlier because all state it
>> looks at is random garbage, so it returns the wrong entry to
>> __nf_conntrack_find_get.
>
> If an entry can be found, it can't be random garbage.
> We never link entries into global table until state has been set up.
But... we don't hold a reference to the entry. So say it's in the
table with valid state, now ____nf_conntrack_find discovers it, now
the entry is removed and reused a dozen of times will all associated
state reinitialization. And nf_ct_key_equal looks at it concurrently
and decides if it's the entry we are looking for or now. I think
unless we hold a ref to the entry, it's state needs to be considered
random garbage for correctness reasoning.
>> Now (nf_ct_is_dying(ct) || !atomic_inc_not_zero(&ct->ct_general.use))
>> check in __nf_conntrack_find_get passes, and it returns NULL to the
>> caller (which means entry is not present).
>
> So entry is going away or marked as dead which for us is same as
> 'not present', we need to allocate a new entry.
>
>> While in reality the entry
>> is present, but we were just looking at the wrong one.
>
> We never add tuples that are identical to the global table.
>
> If N cores receive identical packets at same time with no prior state, all
> will allocate a new conntrack, but we notice this when we try to insert the
> nf_conn entries into the table.
>
> Only one will succeed, other cpus have to cope with this.
> (worst case: all raced packets are dropped along with their conntrack
> object).
>
> For lookup, we have following scenarios:
>
> 1. It doesn't exist -> new allocation needed
> 2. It exists, not dead, has nonzero refount -> use it
> 3. It exists, but marked as dying -> new allocation needed
> 4. It exists but has 0 reference count -> new allocation needed
> 5. It exists, we get reference, but 2nd nf_ct_key_equal check
> fails. We saw a matching 'old incarnation' that just got
> re-used on other core. -> retry lookup
>
>> Also I am not sure about order of checks in (nf_ct_is_dying(ct) ||
>> !atomic_inc_not_zero(&ct->ct_general.use)), because checking state
>> before taking the ref is only a best-effort hint, so it can actually
>> be a dying entry when we take a ref.
>
> Yes, it can also become a dying entry after we took the reference.
>
>> So shouldn't it read something like the following?
>>
>> rcu_read_lock();
>> begin:
>> h = ____nf_conntrack_find(net, zone, tuple, hash);
>> if (h) {
>> ct = nf_ct_tuplehash_to_ctrack(h);
>> if (!atomic_inc_not_zero(&ct->ct_general.use))
>> goto begin;
>> if (unlikely(nf_ct_is_dying(ct)) ||
>> unlikely(!nf_ct_key_equal(h, tuple, zone, net))) {
>> nf_ct_put(ct);
>
> It would be ok to make this change, but dying bit can be set
> at any time e.g. because userspace tells kernel to flush the conntrack table.
> So refcount is always > 0 when the DYING bit is set.
>
> I don't see why it would be a problem.
>
> nf_conn struct will stay valid until all cpus have dropped references.
> The check in lookup function only serves to hide the known-to-go-away entry.
next prev parent reply other threads:[~2018-08-01 10:41 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-31 17:01 SLAB_TYPESAFE_BY_RCU without constructors (was Re: [PATCH v4 13/17] khwasan: add hooks implementation) Andrey Ryabinin
2018-07-31 17:09 ` Florian Westphal
2018-07-31 17:32 ` Eric Dumazet
2018-07-31 17:36 ` Christopher Lameter
2018-07-31 17:41 ` Eric Dumazet
2018-07-31 17:51 ` Dmitry Vyukov
2018-07-31 18:16 ` Eric Dumazet
2018-07-31 17:49 ` Linus Torvalds
2018-07-31 18:51 ` Linus Torvalds
2018-08-01 8:46 ` Dmitry Vyukov
2018-08-01 9:10 ` Dmitry Vyukov
2018-08-01 10:35 ` Florian Westphal
2018-08-01 10:41 ` Dmitry Vyukov [this message]
2018-08-01 11:40 ` Florian Westphal
2018-08-01 12:38 ` Dmitry Vyukov
2018-08-01 13:46 ` Florian Westphal
2018-08-01 13:52 ` Dmitry Vyukov
2018-08-06 20:20 ` Jan Kara
2018-08-01 9:03 ` Andrey Ryabinin
2018-08-01 10:23 ` Eric Dumazet
2018-08-01 10:34 ` Dmitry Vyukov
2018-08-01 11:28 ` Eric Dumazet
2018-08-01 11:35 ` Dmitry Vyukov
2018-08-01 15:15 ` Christopher Lameter
2018-08-01 15:37 ` Eric Dumazet
2018-08-01 15:51 ` Misuse of constructors Matthew Wilcox
2018-08-01 15:53 ` SLAB_TYPESAFE_BY_RCU without constructors (was Re: [PATCH v4 13/17] khwasan: add hooks implementation) Dmitry Vyukov
2018-08-01 16:22 ` Christopher Lameter
2018-08-01 16:25 ` Eric Dumazet
2018-08-01 16:47 ` Dmitry Vyukov
2018-08-01 17:18 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACT4Y+aHWpgDZygXv=smWwdVMWfjpedyajuVvvLDGMK-wFD5Lw@mail.gmail.com' \
--to=dvyukov@google.com \
--cc=airlied@linux.ie \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=aryabinin@virtuozzo.com \
--cc=cl@linux.com \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=dccp@vger.kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=gerrit@erg.abdn.ac.uk \
--cc=gregkh@linuxfoundation.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jack@suse.com \
--cc=jani.nikula@linux.intel.com \
--cc=joonas.lahtinen@linux.intel.com \
--cc=kadlec@blackhole.kfki.hu \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-s390@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=rodrigo.vivi@intel.com \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=ubraun@linux.ibm.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).