From patchwork Mon Oct 24 11:27:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 9290 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp463447wru; Mon, 24 Oct 2022 06:47:59 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4ujXBcRpMgOiII1cBompevuoQycB08j5nQgtU/uE1av2HKAjcu8g9kIKKJ7BOihHwWRkta X-Received: by 2002:a17:907:7250:b0:791:9093:47f7 with SMTP id ds16-20020a170907725000b00791909347f7mr27799036ejc.278.1666619268526; Mon, 24 Oct 2022 06:47:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666619268; cv=none; d=google.com; s=arc-20160816; b=zvIanFJzsD3kWwJmxGPjXokCcX15Ht5Jk3JAk2KIBra7RzpMu5z20tsnj4QR6OooUh 670TWXFCFfhMjiJLhPg6xOnDi40RG2OTnkL38NgLN7uUi8rh5Af1E/Z6g5KMNiwaWFJp CvA51bVgGuopBsUEd6ORKMhjmfqEhxm6H2DtnBu9aKVLxOwkjgAjY4n4nPbx6LOY5BCo sqZAN7QopBUqDq3n7oSuXDqAVoZP4Qzez8KlwEK7H9oyY2Iyrd8ECH3QLI60+WpDdE9h mMmPaAS8ZTecITFhbSU3kezMtCQdWxKdlDG7uVcU2P4uwFr9au3xqkPn8gNIeRnfSCMO hzpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=dUAIDqvHJp4Rnhx8ss/LysEuUJFeJuqfZRowiXu1gZc=; b=pG6TWG1i/0qiZv8YGAIb4Z1RiOxA5XhzYxV4r+W+PHB7T6lxoJd496DXnQlfYRkKQF n52jVyZ9h+1ygL73tON0ydR2Iup121AjmhJsGo7gWM6DmTHXNtZk7aQfUxC4HpxtdI2Y uFS3StgL/fcnuOGvqMgZddyxM/vICdefgq+5+2kln1Cwr44XzgMDKw5ezpdRPQSpO8po UiaHjUuTWOv1Upf7JP791D6hj0YXRvBLNfAwCJ7LMuiXIDlH2mldiwKpnYBYAL9ziwxx 13adLjlduZxQazoIKe5f1+3rMGzPN52p3CTDP5mq5GjxKHbjRW2kFqYmCnukm9K9fB/c BpHQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Z7w2STae; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h11-20020a170906260b00b0078d2a99972fsi23355133ejc.316.2022.10.24.06.47.23; Mon, 24 Oct 2022 06:47:48 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Z7w2STae; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231623AbiJXNqH (ORCPT + 99 others); Mon, 24 Oct 2022 09:46:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55284 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236462AbiJXNoQ (ORCPT ); Mon, 24 Oct 2022 09:44:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 779B315730; Mon, 24 Oct 2022 05:39:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3A81761337; Mon, 24 Oct 2022 12:37:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4CA22C433C1; Mon, 24 Oct 2022 12:37:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666615067; bh=DMg/dpC3WtIiDSMomqCdSakPU8Fi1eLhOH+flNDWjBk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z7w2STaetkgqk6drzdtUr9f0E3iMRWUppWlxFmAckEfyqZKYZY8BKzkUZZmwgB55B hd3lgjnhrGkPN2fy2Bb5Hx/WT6Lanw33K9du42Mg8Crysd3s0JbMEgTL0ZtiX5tCcE b28eAjnk3qRdLEeEqIal2e6mOEi1QSPInUL7f2ls= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ingo Molnar , Andrew Morton , "Jiazi.Li" , "Steven Rostedt (Google)" Subject: [PATCH 5.15 110/530] ring-buffer: Fix race between reset page and reading page Date: Mon, 24 Oct 2022 13:27:34 +0200 Message-Id: <20221024113050.004478408@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024113044.976326639@linuxfoundation.org> References: <20221024113044.976326639@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747576965922716463?= X-GMAIL-MSGID: =?utf-8?q?1747576965922716463?= From: Steven Rostedt (Google) commit a0fcaaed0c46cf9399d3a2d6e0c87ddb3df0e044 upstream. The ring buffer is broken up into sub buffers (currently of page size). Each sub buffer has a pointer to its "tail" (the last event written to the sub buffer). When a new event is requested, the tail is locally incremented to cover the size of the new event. This is done in a way that there is no need for locking. If the tail goes past the end of the sub buffer, the process of moving to the next sub buffer takes place. After setting the current sub buffer to the next one, the previous one that had the tail go passed the end of the sub buffer needs to be reset back to the original tail location (before the new event was requested) and the rest of the sub buffer needs to be "padded". The race happens when a reader takes control of the sub buffer. As readers do a "swap" of sub buffers from the ring buffer to get exclusive access to the sub buffer, it replaces the "head" sub buffer with an empty sub buffer that goes back into the writable portion of the ring buffer. This swap can happen as soon as the writer moves to the next sub buffer and before it updates the last sub buffer with padding. Because the sub buffer can be released to the reader while the writer is still updating the padding, it is possible for the reader to see the event that goes past the end of the sub buffer. This can cause obvious issues. To fix this, add a few memory barriers so that the reader definitely sees the updates to the sub buffer, and also waits until the writer has put back the "tail" of the sub buffer back to the last event that was written on it. To be paranoid, it will only spin for 1 second, otherwise it will warn and shutdown the ring buffer code. 1 second should be enough as the writer does have preemption disabled. If the writer doesn't move within 1 second (with preemption disabled) something is horribly wrong. No interrupt should last 1 second! Link: https://lore.kernel.org/all/20220830120854.7545-1-jiazi.li@transsion.com/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=216369 Link: https://lkml.kernel.org/r/20220929104909.0650a36c@gandalf.local.home Cc: Ingo Molnar Cc: Andrew Morton Cc: stable@vger.kernel.org Fixes: c7b0930857e22 ("ring-buffer: prevent adding write in discarded area") Reported-by: Jiazi.Li Signed-off-by: Steven Rostedt (Google) Signed-off-by: Greg Kroah-Hartman --- kernel/trace/ring_buffer.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -2612,6 +2612,9 @@ rb_reset_tail(struct ring_buffer_per_cpu /* Mark the rest of the page with padding */ rb_event_set_padding(event); + /* Make sure the padding is visible before the write update */ + smp_wmb(); + /* Set the write back to the previous setting */ local_sub(length, &tail_page->write); return; @@ -2623,6 +2626,9 @@ rb_reset_tail(struct ring_buffer_per_cpu /* time delta must be non zero */ event->time_delta = 1; + /* Make sure the padding is visible before the tail_page->write update */ + smp_wmb(); + /* Set write to end of buffer */ length = (tail + length) - BUF_PAGE_SIZE; local_sub(length, &tail_page->write); @@ -4587,6 +4593,33 @@ rb_get_reader_page(struct ring_buffer_pe arch_spin_unlock(&cpu_buffer->lock); local_irq_restore(flags); + /* + * The writer has preempt disable, wait for it. But not forever + * Although, 1 second is pretty much "forever" + */ +#define USECS_WAIT 1000000 + for (nr_loops = 0; nr_loops < USECS_WAIT; nr_loops++) { + /* If the write is past the end of page, a writer is still updating it */ + if (likely(!reader || rb_page_write(reader) <= BUF_PAGE_SIZE)) + break; + + udelay(1); + + /* Get the latest version of the reader write value */ + smp_rmb(); + } + + /* The writer is not moving forward? Something is wrong */ + if (RB_WARN_ON(cpu_buffer, nr_loops == USECS_WAIT)) + reader = NULL; + + /* + * Make sure we see any padding after the write update + * (see rb_reset_tail()) + */ + smp_rmb(); + + return reader; }