LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Peter Zijlstra <a.p.zijlstra@chello.nl>
To: Andy Whitcroft <apw@shadowen.org>
Cc: Christoph Lameter <clameter@sgi.com>,
	Andrea Arcangeli <andrea@qumranet.com>, Robin Holt <holt@sgi.com>,
	Avi Kivity <avi@qumranet.com>, Izik Eidus <izike@qumranet.com>,
	Nick Piggin <npiggin@suse.de>,
	kvm-devel@lists.sourceforge.net,
	Benjamin Herrenschmidt <benh@kernel.crashing.org>,
	steiner@sgi.com, linux-kernel@vger.kernel.org,
	linux-mm@kvack.org, daniel.blueman@quadrics.com,
	Hugh Dickins <hugh@veritas.com>
Subject: Re: [patch 1/6] mmu_notifier: Core code
Date: Tue, 05 Feb 2008 19:17:52 +0100	[thread overview]
Message-ID: <1202235473.19243.25.camel@lappy> (raw)
In-Reply-To: <20080205180557.GC29502@shadowen.org>


On Tue, 2008-02-05 at 18:05 +0000, Andy Whitcroft wrote:

> > +	if (unlikely(!hlist_empty(&mm->mmu_notifier.head))) {
> > +		rcu_read_lock();
> > +		hlist_for_each_entry_safe_rcu(mn, n, t,
> > +					  &mm->mmu_notifier.head, hlist) {
> > +			if (mn->ops->release)
> > +				mn->ops->release(mn, mm);
> 
> Does this ->release actually release the 'nm' and its associated hlist?
> I see in this thread that this ordering is deemed "use after free" which
> implies so.
> 
> If it does that seems wrong.  This is an RCU hlist, therefore the list
> integrity must be maintained through the next grace period in case there
> are parallell readers using the element, in particular its forward
> pointer for traversal.

That is not quite so, list elements must be preserved, not the list
order.

> 
> > +			hlist_del(&mn->hlist);
> 
> For this to be updating the list, you must have some form of "write-side"
> exclusion as these primatives are not "parallel write safe".  It would
> be helpful for this routine to state what that write side exclusion is.

Yeah, has been noticed, read on in the thread :-)

> I am not sure it makes sense to add a _safe_rcu variant.  As I understand
> things an _safe variant is used where we are going to remove the current
> list element in the middle of a list walk.  However the key feature of an
> RCU data structure is that it will always be in a "safe" state until any
> parallel readers have completed.  For an hlist this means that the removed
> entry and its forward link must remain valid for as long as there may be
> a parallel reader traversing this list, ie. until the next grace period.
> If this link is valid for the parallel reader, then it must be valid for
> us, and if so it feels that hlist_for_each_entry_rcu should be sufficient
> to cope in the face of entries being unlinked as we traverse the list.

It does make sense, hlist_del_rcu() maintains the fwd reference, but it
does unlink it from the list proper. As long as there is a write side
exclusion around the actual removal as you noted.

rcu_read_lock();
hlist_for_each_entry_safe_rcu(tpos, pos, n, head, member) {

	if (foo) {
		spin_lock(write_lock);
		hlist_del_rcu(tpos);
		spin_unlock(write_unlock);
	}
}
rcu_read_unlock();

is a safe construct in that the list itself stays a proper list, and
even items that might be caught in the to-be-deleted entries will have a
fwd way out.


  reply	other threads:[~2008-02-05 18:18 UTC|newest]

Thread overview: 97+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-01-28 20:28 [patch 0/6] [RFC] MMU Notifiers V2 Christoph Lameter
2008-01-28 20:28 ` [patch 1/6] mmu_notifier: Core code Christoph Lameter
2008-01-28 22:06   ` Christoph Lameter
2008-01-29  0:05   ` Robin Holt
2008-01-29  1:19     ` Christoph Lameter
2008-01-29 13:59   ` Andrea Arcangeli
2008-01-29 14:34     ` Andrea Arcangeli
2008-01-29 19:49     ` Christoph Lameter
2008-01-29 20:41       ` Avi Kivity
2008-01-29 16:07   ` Robin Holt
2008-02-05 18:05   ` Andy Whitcroft
2008-02-05 18:17     ` Peter Zijlstra [this message]
2008-02-05 18:19     ` Christoph Lameter
2008-01-28 20:28 ` [patch 2/6] mmu_notifier: Callbacks to invalidate address ranges Christoph Lameter
2008-01-29 16:20   ` Andrea Arcangeli
2008-01-29 18:28     ` Andrea Arcangeli
2008-01-29 20:30       ` Christoph Lameter
2008-01-29 21:36         ` Andrea Arcangeli
2008-01-29 21:53           ` Christoph Lameter
2008-01-29 22:35             ` Andrea Arcangeli
2008-01-29 22:55               ` Christoph Lameter
2008-01-29 23:43                 ` Andrea Arcangeli
2008-01-30  0:34                   ` Christoph Lameter
2008-01-29 19:55     ` Christoph Lameter
2008-01-29 21:17       ` Andrea Arcangeli
2008-01-29 21:35         ` Christoph Lameter
2008-01-29 22:02           ` Andrea Arcangeli
2008-01-29 22:39             ` Christoph Lameter
2008-01-30  0:00               ` Andrea Arcangeli
2008-01-30  0:05                 ` Andrea Arcangeli
2008-01-30  0:22                   ` Christoph Lameter
2008-01-30  0:59                     ` Andrea Arcangeli
2008-01-30  8:26                       ` Peter Zijlstra
2008-01-30  0:20                 ` Christoph Lameter
2008-01-30  0:28                   ` Jack Steiner
2008-01-30  0:35                     ` Christoph Lameter
2008-01-30 13:37                     ` Andrea Arcangeli
2008-01-30 14:43                       ` Jack Steiner
2008-01-30 19:41                         ` Christoph Lameter
2008-01-30 20:29                           ` Jack Steiner
2008-01-30 20:55                             ` Christoph Lameter
2008-01-30 16:11                 ` Robin Holt
2008-01-30 17:04                   ` Andrea Arcangeli
2008-01-30 17:30                     ` Robin Holt
2008-01-30 18:25                       ` Andrea Arcangeli
2008-01-30 19:50                         ` Christoph Lameter
2008-01-30 22:18                           ` Robin Holt
2008-01-30 23:52                           ` Andrea Arcangeli
2008-01-31  0:01                             ` Christoph Lameter
2008-01-31  0:34                               ` [kvm-devel] " Andrea Arcangeli
2008-01-31  1:46                                 ` Christoph Lameter
2008-01-31  2:34                                   ` Robin Holt
2008-01-31  2:37                                     ` Christoph Lameter
2008-01-31  2:56                                     ` [kvm-devel] mmu_notifier: invalidate_range_start with lock=1 Christoph Lameter
2008-01-31 10:52                                   ` [kvm-devel] [patch 2/6] mmu_notifier: Callbacks to invalidate address ranges Andrea Arcangeli
2008-01-31  2:08                                 ` Christoph Lameter
2008-01-31  2:42                                   ` Andrea Arcangeli
2008-01-31  2:51                                     ` Christoph Lameter
2008-01-31 13:39                                       ` Andrea Arcangeli
2008-01-30 19:35                   ` Christoph Lameter
2008-01-28 20:28 ` [patch 3/6] mmu_notifier: invalidate_page callbacks for subsystems with rmap Christoph Lameter
2008-01-29 16:28   ` Robin Holt
2008-01-28 20:28 ` [patch 4/6] MMU notifier: invalidate_page callbacks using Linux rmaps Christoph Lameter
2008-01-29 14:03   ` Andrea Arcangeli
2008-01-29 14:24     ` Andrea Arcangeli
2008-01-29 19:51       ` Christoph Lameter
2008-01-28 20:28 ` [patch 5/6] mmu_notifier: Callbacks for xip_filemap.c Christoph Lameter
2008-01-28 20:28 ` [patch 6/6] mmu_notifier: Add invalidate_all() Christoph Lameter
2008-01-29 16:31   ` Robin Holt
2008-01-29 20:02     ` Christoph Lameter
2008-01-30  2:29 [patch 0/6] [RFC] MMU Notifiers V3 Christoph Lameter
2008-01-30  2:29 ` [patch 1/6] mmu_notifier: Core code Christoph Lameter
2008-01-30 15:37   ` Andrea Arcangeli
2008-01-30 15:53     ` Jack Steiner
2008-01-30 16:38       ` Andrea Arcangeli
2008-01-30 19:19       ` Christoph Lameter
2008-01-30 22:20         ` Robin Holt
2008-01-30 23:38           ` Andrea Arcangeli
2008-01-30 23:55             ` Christoph Lameter
2008-01-30 17:10     ` Peter Zijlstra
2008-01-30 19:28       ` Christoph Lameter
2008-01-30 18:02   ` Robin Holt
2008-01-30 19:08     ` Christoph Lameter
2008-01-30 19:14     ` Christoph Lameter
2008-02-08 22:06 [patch 0/6] MMU Notifiers V6 Christoph Lameter
2008-02-08 22:06 ` [patch 1/6] mmu_notifier: Core code Christoph Lameter
2008-02-15  6:48 [patch 0/6] MMU Notifiers V7 Christoph Lameter
2008-02-15  6:49 ` [patch 1/6] mmu_notifier: Core code Christoph Lameter
2008-02-16  3:37   ` Andrew Morton
2008-02-16  8:45     ` Avi Kivity
2008-02-16  8:56       ` Andrew Morton
2008-02-16  9:21         ` Avi Kivity
2008-02-16 10:41     ` Brice Goglin
2008-02-16 10:58       ` Andrew Morton
2008-02-16 19:31         ` Christoph Lameter
2008-02-16 19:21     ` Christoph Lameter
2008-02-17  3:01       ` Andrea Arcangeli
2008-02-17 12:24         ` Robin Holt
2008-02-17  5:04     ` Doug Maxey
2008-02-18 22:33   ` Roland Dreier

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1202235473.19243.25.camel@lappy \
    --to=a.p.zijlstra@chello.nl \
    --cc=andrea@qumranet.com \
    --cc=apw@shadowen.org \
    --cc=avi@qumranet.com \
    --cc=benh@kernel.crashing.org \
    --cc=clameter@sgi.com \
    --cc=daniel.blueman@quadrics.com \
    --cc=holt@sgi.com \
    --cc=hugh@veritas.com \
    --cc=izike@qumranet.com \
    --cc=kvm-devel@lists.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=npiggin@suse.de \
    --cc=steiner@sgi.com \
    --subject='Re: [patch 1/6] mmu_notifier: Core code' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).