linux-kernel - Re: x86 rwsem: up_read() does not check active count in fast path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 04 May 2010 13:41:36 +0100
From:	David Howells <dhowells@...hat.com>
To:	Michel Lespinasse <walken@...gle.com>
Cc:	dhowells@...hat.com, Andrew Morton <akpm@...gle.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: x86 rwsem: up_read() does not check active count in fast path

Michel Lespinasse <walken@...gle.com> wrote:

> Looking at the x86 rwsem code, I have been wondering about the up_read()
> path.  __rwsem_do_wake() comment mentions that one should check the active
> count on the way there; however I could not find that check when coming from
> up_read().

Look in call_rwsem_wake(), which is implemented in assembly in two places in
the x86 arch:

	arch/x86/lib/rwsem_64.S
	arch/x86/lib/semaphore_32.S

Note that the x86_64 version contains a bug, a patch for which is attached.

David
---
From: David Howells <dhowells@...hat.com>
Subject: [PATCH] Fix the x86_64 implementation of call_rwsem_wait()

The x86_64 call_rwsem_wait() treats the active state counter part of the R/W
semaphore state as being 16-bit when it's actually 32-bit (it's half of the
64-bit state).  It should do "decl %edx" not "decw %dx".

Signed-off-by: David Howells <dhowells@...hat.com>
---

 arch/x86/lib/rwsem_64.S |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)


diff --git a/arch/x86/lib/rwsem_64.S b/arch/x86/lib/rwsem_64.S
index 15acecf..41fcf00 100644
--- a/arch/x86/lib/rwsem_64.S
+++ b/arch/x86/lib/rwsem_64.S
@@ -60,7 +60,7 @@ ENTRY(call_rwsem_down_write_failed)
 	ENDPROC(call_rwsem_down_write_failed)
 
 ENTRY(call_rwsem_wake)
-	decw %dx    /* do nothing if still outstanding active readers */
+	decl %edx	/* do nothing if still outstanding active readers */
 	jnz 1f
 	save_common_regs
 	movq %rax,%rdi
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/