Re: [git pull] vfs pile 1 (splice)

From	Linus Torvalds <torvalds@linux-foundation.org>
Newsgroups	linux.kernel
Subject	Re: [git pull] vfs pile 1 (splice)
Date	2016-10-10 22:10 +0200
Message-ID	<sqP3A-5Ds-19@gated-at.bofh.it> (permalink)
References	<spLOp-6SF-31@gated-at.bofh.it> <sqft7-vM-7@gated-at.bofh.it> <sqrkB-7O8-7@gated-at.bofh.it> <sqJrb-2eB-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, Oct 10, 2016 at 7:03 AM, Christoph Lameter <cl@linux.com> wrote:
>
> Hmm.. Then get_freepointer_safe may not be ok. Should not trigger any
> faults.

So the reason seems to be that SLUB doesn't actually react well to
double-freeing bugs.

I'm not sure how to fix that. I think the optimistic load that SLUB
does is actually important, since it is what allows the whole
lock-free double_cmpxchg() approach.

But the fact that it reacts _so_ badly to double-freeing issues when
the freelist has become corrupted due to an object being free'd and
then modified is clearly very fragile and not great.

Doing a google search for "kmalloc", "oops" and "cmpxchg16b" does show
that it happens: you can tell by how the trapping instruction is a
load just before the cmpxchg16b instruction in the oops disassembly.

Maybe we should just make "get_freepointer()" always handle traps.
Right now it does that "probe_kernel_read()" conditionally, and it's a
fairly costly operation, but we *could* make it cheaper. It's really
just a single instruction with an exception entry (kind of like
load_unaligned_zeropad() that we wrote for the dcache case).

I dunno.

                Linus

Thread

[git pull] vfs pile 1 (splice) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-08 00:30 +0200
  Re: [git pull] vfs pile 1 (splice) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-09 08:10 +0200
    Re: [git pull] vfs pile 1 (splice) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-09 20:50 +0200
      Re: [git pull] vfs pile 1 (splice) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-09 21:20 +0200
      Re: [git pull] vfs pile 1 (splice) Christoph Lameter <cl@linux.com> - 2016-10-10 16:10 +0200
        Re: [git pull] vfs pile 1 (splice) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-10 22:10 +0200
          Re: [git pull] vfs pile 1 (splice) Christoph Lameter <cl@linux.com> - 2016-10-12 16:20 +0200

csiph-web