Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CAEHB248ZfrhSr3V3Ag59fCPoBmm+O==mFrgq7xQipoSgew_Row@mail.gmail.com>
 <20220818192852.0934313f@gandalf.local.home>
In-Reply-To: <20220818192852.0934313f@gandalf.local.home>
From:   Gabriel Ryan <gabe@cs.columbia.edu>
Date:   Mon, 22 Aug 2022 12:23:41 -0400
Message-ID: <CALbthte5MZbXfWh05NqHOXvUWx9dLL7OxT9Lf7+aALiYb4u_5w@mail.gmail.com>
Subject: Re: data-race in pcpu_alloc / pcpu_nr_pages
To:     Steven Rostedt <rostedt@goodmis.org>
Cc:     Abhishek Shah <abhishek.shah@columbia.edu>,
        linux-kernel@vger.kernel.org, mingo@redhat.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Steve,

Makes sense, thanks for taking the time to review this for us!

Best,

Gabe


On Thu, Aug 18, 2022 at 7:28 PM Steven Rostedt <rostedt@goodmis.org> wrote:
>
> On Thu, 18 Aug 2022 18:29:00 -0400
> Abhishek Shah <abhishek.shah@columbia.edu> wrote:
>
> > Hi all,
> >
> > We found a race involving the *pcpu_nr_populated *variable. We discover=
ed
> > that the racing variable is used in meminfo_proc_show
> > <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__elixir.bootlin.=
com_linux_v5.18-2Drc5_source_fs_proc_meminfo.c-23L123&d=3DDwICAg&c=3D009klH=
SCxuh5AI1vNQzSO0KGjl4nbi2Q0M1QLJX9BeE&r=3DEyAJYRJu01oaAhhVVY3o8zKgZvacDAXd_=
PNRtaqACCo&m=3DJaafDoHfUv9wBvITwFrxb8GW82J0sFuH-p1ItZM6jxU4b2c4UzG6SAgIIAX_=
vLz9&s=3DAHf4mjYOVq3qPnt65oFSjl4kztRIYFGagjntxAqUFWE&e=3D  >,
> > but we were not sure if there were other security-relevant implications=
 of
> > this race. Please let us know what you think.
>
> So you see that the number displayed in meminfo can be written to while
> it's being read?  As it's a long value, it is likely to be accurate (the
> value before or after the update). pcpu_nr_pages() is only used to displa=
y
> the number of pages in meminfo.
>
> I don't see any problem here.
>
> -- Steve

--=20
Gabriel Ryan
PhD Candidate at Columbia University