linux-kernel - Re: [-rt] Fix race condition and following BUG in PI-futex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 2 Aug 2006 21:48:00 -0700
From:	Darren Hart <dvhltc@...ibm.com>
To:	Esben Nielsen <nielsen.esben@...glemail.com>
Cc:	Steven Rostedt <rostedt@...dmis.org>, Ingo Molnar <mingo@...e.hu>,
	Thomas Gleixner <tglx@...utronix.de>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [-rt] Fix race condition and following BUG in PI-futex

On Tuesday 01 August 2006 16:28, you wrote:
> On Tue, 1 Aug 2006, Steven Rostedt wrote:
> > On Tue, 2006-08-01 at 13:22 -0700, Darren Hart wrote:
> >>>>   	list_del_init(&pi_state->owner->pi_state_list);
> >>>>   	list_add(&pi_state->list, &new_owner->pi_state_list);
> >>>>   	pi_state->owner = new_owner;
> >>>> +	atomic_inc(&pi_state->refcount);
> >>>
> >>> There really needs to be a get_pi_state() or some variant. Having to do
> >>> a manual atomic_inc is very dangerous.
> >>
> >> I understand the need to grab the wait_lock in order to serialize
> >> rt_mutex_next_owner(), but why the addition of of the atomic_inc() and
> >> the free_pi_state() ?  And if we do need them, shouldn't we place them
> >> around the use of the pi_state, rather than just before the unlock
> >> calls?
> >
> > Hmm, is the inc really needed?  The hb->lock is held through this and
> > the pi_state can't go away while that lock is held.
>
> I was going to ask about that... If you say so they can go. I just added
> the inc/dec to be sure.

So the only thing that frees the pi_state is free_pi_state and it's only 
caller is unqueue_me_pi() which must be called with hb->lock held, so since
we already hold it, I think we're fine without the inc/free lines (as Steven
already said).  The following patch has the lines removed.

The direct use of the rt_mutex wait_lock seems a little out of place here, as
it "ought to be" restricted to rt_mutex.c.  Perhaps some kind of an "atomic"
rt_mutex_set_next_owner() call could abstract this away from futex.c?  I 
confess I don't see a way to do that without putting futex internals into
rt_mutex.c... so not really any better.


Index: 2.6.17-rt8/kernel/futex.c
===================================================================
--- 2.6.17-rt8.orig/kernel/futex.c	2006-08-02 20:29:42.000000000 -0700
+++ 2.6.17-rt8/kernel/futex.c	2006-08-02 21:39:17.000000000 -0700
@@ -565,6 +565,7 @@
 	if (!pi_state)
 		return -EINVAL;
 
+	spin_lock(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
 	/*
@@ -598,6 +599,8 @@
 	list_del_init(&pi_state->owner->pi_state_list);
 	list_add(&pi_state->list, &new_owner->pi_state_list);
 	pi_state->owner = new_owner;
+
+	spin_unlock(&pi_state->pi_mutex.wait_lock);
 	rt_mutex_unlock(&pi_state->pi_mutex);
 
 	return 0;



-- 
Darren Hart
IBM Linux Technology Center
Realtime Linux Team
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/