Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <1680266529-28429-1-git-send-email-ziwei.dai@unisoc.com> <CAEXW_YR5MZhHuDsMVEB8A=80k3sjecp-yTXNLv6XCaq9h2JH2A@mail.gmail.com>
In-Reply-To: <CAEXW_YR5MZhHuDsMVEB8A=80k3sjecp-yTXNLv6XCaq9h2JH2A@mail.gmail.com>
From:   Joel Fernandes <joel@joelfernandes.org>
Date:   Wed, 5 Apr 2023 14:12:02 -0400
Message-ID: <CAEXW_YRtV7pAYR-UyVNNsgPJ2dmBGrV+DkNROOivXj3MChDgGw@mail.gmail.com>
Subject: Re: [PATCH V2] rcu: Make sure new krcp free business is handled after
 the wanted rcu grace period.
To:     Ziwei Dai <ziwei.dai@unisoc.com>
Cc:     urezki@gmail.com, paulmck@kernel.org, frederic@kernel.org,
        quic_neeraju@quicinc.com, josh@joshtriplett.org,
        rostedt@goodmis.org, mathieu.desnoyers@efficios.com,
        jiangshanlai@gmail.com, rcu@vger.kernel.org,
        linux-kernel@vger.kernel.org, shuang.wang@unisoc.com,
        yifan.xin@unisoc.com, ke.wang@unisoc.com, xuewen.yan@unisoc.com,
        zhiguo.niu@unisoc.com, zhaoyang.huang@unisoc.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Wed, Apr 5, 2023 at 1:39=E2=80=AFPM Joel Fernandes <joel@joelfernandes.o=
rg> wrote:
>
> On Fri, Mar 31, 2023 at 8:43=E2=80=AFAM Ziwei Dai <ziwei.dai@unisoc.com> =
wrote:
> >
> > In kfree_rcu_monitor(), new free business at krcp is attached to any fr=
ee
> > channel at krwp. kfree_rcu_monitor() is responsible to make sure new fr=
ee
> > business is handled after the rcu grace period. But if there is any non=
e-free
> > channel at krwp already, that means there is an on-going rcu work,
> > which will cause the kvfree_call_rcu()-triggered free business is done
> > before the wanted rcu grace period ends.
> >
> > This commit ignore krwp which has non-free channel at kfree_rcu_monitor=
(),
> > to fix the issue that kvfree_call_rcu() loses effectiveness.
> >
> > Below is the css_set obj "from_cset" use-after-free case caused by
> > kvfree_call_rcu() losing effectiveness.
> > CPU 0 calls rcu_read_lock(), then use "from_cset", then hard irq comes,
> > the task is schedule out.
> > CPU 1 calls kfree_rcu(cset, rcu_head), willing to free "from_cset" afte=
r new gp.
> > But "from_cset" is freed right after current gp end. "from_cset" is rea=
llocated.
> > CPU 0 's task arrives back, references "from_cset"'s member, which caus=
es crash.
> >
> > CPU 0                                   CPU 1
> > count_memcg_event_mm()
> > |rcu_read_lock()  <---
> > |mem_cgroup_from_task()
> >  |// css_set_ptr is the "from_cset" mentioned on CPU 1
> >  |css_set_ptr =3D rcu_dereference((task)->cgroups)
> >  |// Hard irq comes, current task is scheduled out.
> >
> >                                         cgroup_attach_task()
> >                                         |cgroup_migrate()
> >                                         |cgroup_migrate_execute()
> >                                         |css_set_move_task(task, from_c=
set, to_cset, true)
> >                                         |cgroup_move_task(task, to_cset=
)
> >                                         |rcu_assign_pointer(.., to_cset=
)
> >                                         |...
> >                                         |cgroup_migrate_finish()
> >                                         |put_css_set_locked(from_cset)
> >                                         |from_cset->refcount return 0
> >                                         |kfree_rcu(cset, rcu_head) // m=
eans to free from_cset after new gp
> >                                         |add_ptr_to_bulk_krc_lock()
> >                                         |schedule_delayed_work(&krcp->m=
onitor_work, ..)
> >
> >                                         kfree_rcu_monitor()
> >                                         |krcp->bulk_head[0]'s work atta=
ched to krwp->bulk_head_free[]
> >                                         |queue_rcu_work(system_wq, &krw=
p->rcu_work)
> >                                         |if rwork->rcu.work is not in W=
ORK_STRUCT_PENDING_BIT state,
> >                                         |call_rcu(&rwork->rcu, rcu_work=
_rcufn) <--- request a new gp
> >
> >                                         // There is a perious call_rcu(=
.., rcu_work_rcufn)
> >                                         // gp end, rcu_work_rcufn() is =
called.
> >                                         rcu_work_rcufn()
> >                                         |__queue_work(.., rwork->wq, &r=
work->work);
> >
> >                                         |kfree_rcu_work()
> >                                         |krwp->bulk_head_free[0] bulk i=
s freed before new gp end!!!
> >                                         |The "from_cset" is freed befor=
e new gp end.
> >
> > // the task is scheduled in after many ms.
> >  |css_set_ptr->subsys[(subsys_id) <--- Caused kernel crash, because css=
_set_ptr is freed.
> >
> > v2: Use helper function instead of inserted code block at kfree_rcu_mon=
itor().
> >
> > Fixes: c014efeef76a ("rcu: Add multiple in-flight batches of kfree_rcu(=
) work")
> > Signed-off-by: Ziwei Dai <ziwei.dai@unisoc.com>
>
> Please update the fixes tag to:
> 5f3c8d620447 ("rcu/tree: Maintain separate array for vmalloc ptrs")

Vlad pointed out in another thread that the fix is actually to 34c881745549=
.

So just to be sure, it could be updated to:
Fixes: 34c881745549 ("rcu: Support kfree_bulk() interface in kfree_rcu()")
Fixes: 5f3c8d620447 ("rcu/tree: Maintain separate array for vmalloc ptrs")

thanks,

 - Joel