2001-03-07 16:33:01

by Manfred Spraul

[permalink] [raw]
Subject: BUG? race between kswapd and ptrace (access_process_vm )

Is kswapd now running without lock_kernel()?

Then there is a race between swapout and ptrace:
access_process_vm() accesses the page table entries, only protected with
the mmap_sem semaphore and lock_kernel().

Isn't

spin_lock(&mm->page_table_lock);

missing in access_one_page() [in linux/kernel/ptrace.c]?

--
Manfred


2001-03-07 16:58:43

by Rik van Riel

[permalink] [raw]
Subject: Re: BUG? race between kswapd and ptrace (access_process_vm )

On Wed, 7 Mar 2001, Manfred Spraul wrote:

> Is kswapd now running without lock_kernel()?

Indeed ...

> Then there is a race between swapout and ptrace:
> access_process_vm() accesses the page table entries, only protected with
> the mmap_sem semaphore and lock_kernel().
>
> Isn't
>
> spin_lock(&mm->page_table_lock);
>
> missing in access_one_page() [in linux/kernel/ptrace.c]?

You're probably right here ...

regards,

Rik
--
Linux MM bugzilla: http://linux-mm.org/bugzilla.shtml

Virtual memory is like a game you can't win;
However, without VM there's truly nothing to lose...

http://www.surriel.com/
http://www.conectiva.com/ http://distro.conectiva.com/

2001-03-08 20:13:08

by Manfred Spraul

[permalink] [raw]
Subject: Re: BUG? race between kswapd and ptrace (access_process_vm )

Rik van Riel wrote:
>
> On Wed, 7 Mar 2001, Manfred Spraul wrote:
>
> > Is kswapd now running without lock_kernel()?
>
> Indeed ...
>
> > Then there is a race between swapout and ptrace:
> > access_process_vm() accesses the page table entries, only protected with
> > the mmap_sem semaphore and lock_kernel().
> >
> > Isn't
> >
> > spin_lock(&mm->page_table_lock);
> >
> > missing in access_one_page() [in linux/kernel/ptrace.c]?
>
> You're probably right here ...
>

Fixing the bug is more difficult than I thought:

Initially I assumed it would be a two-liner (lock, unlock) but kmap()
can sleep.

Can I reuse a kmap_atomic() type or should I add a new type?

I could add local_irq_save() and (ab)use KMAP_BOUNCE_READ, but I'm not
sure if that's the Right Thing(tm)

--
Manfred

2001-03-12 11:58:47

by Stephen C. Tweedie

[permalink] [raw]
Subject: Re: BUG? race between kswapd and ptrace (access_process_vm )

Hi,

On Thu, Mar 08, 2001 at 09:12:52PM +0100, Manfred Spraul wrote:
> >
> Fixing the bug is more difficult than I thought:
>
> Initially I assumed it would be a two-liner (lock, unlock) but kmap()
> can sleep.
>
> Can I reuse a kmap_atomic() type or should I add a new type?

I've just tried with the patch below and it seems fine. You don't
need to hold the spinlock over the kmap() call: you only need to hold
a reference to the page.

Cheers,
Stephen


Attachments:
(No filename) (460.00 B)
ptrace-fix.diff (1.13 kB)
Download all attachments