| |
|
 |
|
 |
|
|
|
| |
|
|
xen-devel
[Xen-devel] Re: One (possible) x86 get_user_pages bug
|
To: |
Jan Beulich <JBeulich@xxxxxxxxxx> |
|
Subject: |
[Xen-devel] Re: One (possible) x86 get_user_pages bug |
|
From: |
Peter Zijlstra <a.p.zijlstra@xxxxxxxxx> |
|
Date: |
Thu, 27 Jan 2011 16:01:17 +0100 |
|
Cc: |
Kaushik Barde <kbarde@xxxxxxxxxx>, "xen-devel@xxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxx>, Kenneth Lee <liguozhu@xxxxxxxxxx>, Nick Piggin <npiggin@xxxxxxxxx>, linux-kernel@xxxxxxxxxxxxxxx, wangzhenguo@xxxxxxxxxx, Xiaowei Yang <xiaowei.yang@xxxxxxxxxx>, linqaingmin <linqiangmin@xxxxxxxxxx>, fanhenglong@xxxxxxxxxx, Wu Fengguang <fengguang.wu@xxxxxxxxx> |
|
Delivery-date: |
Thu, 27 Jan 2011 18:53:39 -0800 |
|
Envelope-to: |
www-data@xxxxxxxxxxxxxxxxxxx |
|
In-reply-to: |
<4D419416020000780002ECB7@xxxxxxxxxxxxxxxxxx> |
|
List-help: |
<mailto:xen-devel-request@lists.xensource.com?subject=help> |
|
List-id: |
Xen developer discussion <xen-devel.lists.xensource.com> |
|
List-post: |
<mailto:xen-devel@lists.xensource.com> |
|
List-subscribe: |
<http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe> |
|
List-unsubscribe: |
<http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe> |
|
References: |
<4D416D9A.9010603@xxxxxxxxxx> <4D419416020000780002ECB7@xxxxxxxxxxxxxxxxxx> |
|
Sender: |
xen-devel-bounces@xxxxxxxxxxxxxxxxxxx |
On Thu, 2011-01-27 at 14:49 +0000, Jan Beulich wrote:
> >>> On 27.01.11 at 14:05, Xiaowei Yang <xiaowei.yang@xxxxxxxxxx> wrote:
> > We created a scenario to reproduce the bug:
> > ----------------------------------------------------------------
> > // proc1/proc1.2 are 2 threads sharing one page table.
> > // proc1 is the parent of proc2.
> >
> > proc1 proc2 proc1.2
> > ... ... // in gup_pte_range()
> > ... ... pte = gup_get_pte()
> > ... ... page1 = pte_page(pte) // (1)
> > do_wp_page(page1) ... ...
> > ... exit_map() ...
> > ... ... get_page(page1) // (2)
> > -----------------------------------------------------------------
> >
> > do_wp_page() and exit_map() cause page1 to be released into free list
> > before get_page() in proc1.2 is called. The longer the delay between
> > (1)&(2), the easier the BUG_ON shows.
>
> The scenario indeed seems to apply independent of virtualization,
> but the window obviously can be unbounded unless running
> native.
>
> However, going through all the comments in gup.c again I wonder
> whether pv Xen guests don't violate the major assumption: There
> is talk about interrupts being off preventing (or sufficiently
> deferring) remote CPUs doing TLB flushes. In pv Xen guests,
> however, non-local TLB flushes do not happen by sending IPIs -
> the hypercall interface gets used instead. If that's indeed the
> case, I would have expected quite a few bug reports, but I'm
> unaware of any - Nick, am I overlooking something here?
Indeed, the delay of tlb flush ipi's should ensure that the pages aren't
freed and should cover the race with unmap.
If Xen violates this then xen needs to fix this somehow..
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
|
|
|
| |
|
Home