[REVIEW][PATCH] ucount: Remove the atomicity from ucount->count
Eric W. Biederman
ebiederm at xmission.com
Mon Mar 6 21:26:09 UTC 2017
Andrei Vagin <avagin at gmail.com> writes:
> On Sun, Mar 05, 2017 at 03:41:06PM -0600, Eric W. Biederman wrote:
>> Always increment/decrement ucount->count under the ucounts_lock. The
>> increments are there already and moving the decrements there means the
>> locking logic of the code is simpler. This simplification in the
>> locking logic fixes a race between put_ucounts and get_ucounts that
>> could result in a use-after-free because the count could go zero then
>> be found by get_ucounts and then be freed by put_ucounts.
>> A bug presumably this one was found by a combination of syzkaller and
>> KASAN. JongWhan Kim reported the syzkaller failure and Dmitry Vyukov
>> spotted the race in the code.
> Reviewed-by: Andrei Vagin <avagin at gmail.com>
> I think we can rework this in a future so that ucount will be rcu
Agreed. Although I would like to see a benchmark that motivated that.
So far my impression is that all of these counts are in the noise.
Which is why I have aimed more at simplicity than the fastest possible
More information about the Containers