From: Frederic Weisbecker <frederic@kernel.org>
To: David Laight <David.Laight@aculab.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Denis Arefev <arefev@swemel.ru>,
Boqun Feng <boqun.feng@gmail.com>,
Joel Fernandes <joel@joelfernandes.org>,
Josh Triplett <josh@joshtriplett.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
Neeraj Upadhyay <neeraj.upadhyay@amd.com>,
"Paul E . McKenney" <paulmck@kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
Uladzislau Rezki <urezki@gmail.com>, rcu <rcu@vger.kernel.org>
Subject: Re: [PATCH 09/18] srcu: Fix srcu_struct node grpmask overflow on 64-bit systems
Date: Fri, 13 Oct 2023 16:11:32 +0200 [thread overview]
Message-ID: <ZSlQFGIyQGoYETzV@lothringen> (raw)
In-Reply-To: <f6cc79b13ccf471aa275bee88559b6bd@AcuMS.aculab.com>
On Fri, Oct 13, 2023 at 12:54:32PM +0000, David Laight wrote:
> From: Frederic Weisbecker
> > Sent: 13 October 2023 12:59
> >
> > The value of a bitwise expression 1 << (cpu - sdp->mynode->grplo)
> > is subject to overflow due to a failure to cast operands to a larger
> > data type before performing the bitwise operation.
> >
> > The maximum result of this subtraction is defined by the RCU_FANOUT_LEAF
> > Kconfig option, which on 64-bit systems defaults to 16 (resulting in a
> > maximum shift of 15), but which can be set up as high as 64 (resulting
> > in a maximum shift of 63). A value of 31 can result in sign extension,
> > resulting in 0xffffffff80000000 instead of the desired 0x80000000.
> > A value of 32 or greater triggers undefined behavior per the C standard.
> >
> > This bug has not been known to cause issues because almost all kernels
> > take the default CONFIG_RCU_FANOUT_LEAF=16. Furthermore, as long as a
> > given compiler gives a deterministic non-zero result for 1<<N for N>=32,
> > the code correctly invokes all SRCU callbacks, albeit wasting CPU time
> > along the way.
> >
> > This commit therefore substitutes the correct 1UL for the buggy 1.
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Signed-off-by: Denis Arefev <arefev@swemel.ru>
> > Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
> > Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
> > Cc: David Laight <David.Laight@aculab.com>
> > Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
> > Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
> > ---
> > kernel/rcu/srcutree.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
> > index 833a8f848a90..5602042856b1 100644
> > --- a/kernel/rcu/srcutree.c
> > +++ b/kernel/rcu/srcutree.c
> > @@ -223,7 +223,7 @@ static bool init_srcu_struct_nodes(struct srcu_struct *ssp, gfp_t gfp_flags)
> > snp->grplo = cpu;
> > snp->grphi = cpu;
> > }
> > - sdp->grpmask = 1 << (cpu - sdp->mynode->grplo);
> > + sdp->grpmask = 1UL << (cpu - sdp->mynode->grplo);
> > }
> > smp_store_release(&ssp->srcu_sup->srcu_size_state, SRCU_SIZE_WAIT_BARRIER);
> > return true;
> > @@ -835,7 +835,7 @@ static void srcu_schedule_cbs_snp(struct srcu_struct *ssp, struct srcu_node *snp
> > int cpu;
> >
> > for (cpu = snp->grplo; cpu <= snp->grphi; cpu++) {
> > - if (!(mask & (1 << (cpu - snp->grplo))))
> > + if (!(mask & (1UL << (cpu - snp->grplo))))
> > continue;
> > srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, cpu), delay);
> > }
>
> That loop is entirely horrid.
> The compiler almost certainly has to reload snp->grphi every iteration.
> Also it looks as though the bottom bit of mask is checked first.
> So how about:
> grphi = snp->grphi;
> for (cpu = snp->grplo; cpu <= grphi; cpu++, mask >>= 1) {
> if (!(mask & 1))
> continue;
> srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, cpu), delay);
> }
Well, it's cache-hot and RCU update side is not really a fast-path.
Not sure it's worth optimizing...
Thanks.
>
> David
>
> > --
> > 2.34.1
>
> -
> Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
> Registration No: 1397386 (Wales)
>
next prev parent reply other threads:[~2023-10-13 14:11 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-13 11:58 [PATCH 00/18] RCU fixes for v6.7 Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 01/18] Revert "checkpatch: Error out if deprecated RCU API used" Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 02/18] srcu: Fix error handling in init_srcu_struct_fields() Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 03/18] rcu/tree: Remove superfluous return from void call_rcu* functions Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 04/18] rcu: Add sysfs to provide throttled access to rcu_barrier() Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 05/18] rcu: Remove unused function declaration rcu_eqs_special_set() Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 06/18] mm: Remove kmem_valid_obj() Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 07/18] rcu: Dump memory object info if callback function is invalid Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 08/18] rcu: Eliminate rcu_gp_slow_unregister() false positive Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 09/18] srcu: Fix srcu_struct node grpmask overflow on 64-bit systems Frederic Weisbecker
2023-10-13 12:54 ` David Laight
2023-10-13 14:11 ` Frederic Weisbecker [this message]
2023-10-13 11:58 ` [PATCH 10/18] rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 11/18] rcu: Use rcu_segcblist_segempty() instead of open coding it Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 12/18] rcu: Assume IRQS disabled from rcu_report_dead() Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 13/18] rcu: Assume rcu_report_dead() is always called locally Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 14/18] rcu: Conditionally build CPU-hotplug teardown callbacks Frederic Weisbecker
2023-10-13 11:58 ` [PATCH 15/18] rcu: Standardize explicit CPU-hotplug calls Frederic Weisbecker
2023-10-13 11:59 ` [PATCH 16/18] rcu: Comment why callbacks migration can't wait for CPUHP_RCUTREE_PREP Frederic Weisbecker
2023-10-13 11:59 ` [PATCH 17/18] srcu: Fix callbacks acceleration mishandling Frederic Weisbecker
2023-10-13 11:59 ` [PATCH 18/18] srcu: Only accelerate on enqueue time Frederic Weisbecker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZSlQFGIyQGoYETzV@lothringen \
--to=frederic@kernel.org \
--cc=David.Laight@aculab.com \
--cc=arefev@swemel.ru \
--cc=boqun.feng@gmail.com \
--cc=joel@joelfernandes.org \
--cc=josh@joshtriplett.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=neeraj.upadhyay@amd.com \
--cc=paulmck@kernel.org \
--cc=rcu@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=urezki@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).