From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757784AbcJQUEL (ORCPT ); Mon, 17 Oct 2016 16:04:11 -0400 Received: from mx1.redhat.com ([209.132.183.28]:58110 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757041AbcJQUEC (ORCPT ); Mon, 17 Oct 2016 16:04:02 -0400 From: Jeff Moyer To: Peter Zijlstra Cc: Christoph Hellwig , viro@zeniv.linux.org.uk, jack@suse.cz, dmonakhov@openvz.org, linux-fsdevel@vger.kernel.org, linux-aio@kvack.org, linux-kernel@vger.kernel.org, Oleg Nesterov , Mikulas Patocka Subject: Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) References: <1476597082-15317-1-git-send-email-hch@lst.de> <20161017185552.GA24653@lst.de> <20161017195454.GA3568@worktop.programming.kicks-ass.net> X-PGP-KeyID: 1F78E1B4 X-PGP-CertKey: F6FE 280D 8293 F72C 65FD 5A58 1FF8 A7CA 1F78 E1B4 X-PCLoadLetter: What the f**k does that mean? Date: Mon, 17 Oct 2016 16:04:00 -0400 In-Reply-To: <20161017195454.GA3568@worktop.programming.kicks-ass.net> (Peter Zijlstra's message of "Mon, 17 Oct 2016 21:54:54 +0200") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Mon, 17 Oct 2016 20:04:02 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Peter Zijlstra writes: > On Mon, Oct 17, 2016 at 03:40:24PM -0400, Jeff Moyer wrote: >> Christoph Hellwig writes: >> >> > On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote: >> >> This ends up being a call to __sb_end_write: >> >> >> >> void __sb_end_write(struct super_block *sb, int level) >> >> { >> >> percpu_up_read(sb->s_writers.rw_sem + level-1); >> >> } >> >> >> >> Nothing guarantees that submission and completion happen on the same >> >> CPU. Is this safe? >> > >> > Good point. From my reading of the percpu_rwsem implementation it >> > is not safe to release it from a different CPU. Which makes me >> > wonder how we can protect aio writes properly here.. >> >> Could we just change percpu_rw_semaphore->read_count to be a signed >> integer? The down_write path sums up the counters from all cpus... > > To what point? Duh, nevermind. You're right, it should work as-is. -Jeff