linux-kernel - [PATCH RT] ipc: add a critical section in pipelined

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 14 Jul 2011 22:08:53 +0700
From:	KOBAYASHI Yoshitake <yoshitake.kobayashi@...hiba.co.jp>
To:	linux-kernel@...r.kernel.org
Cc:	tglx@...utronix.de, mingo@...hat.com
Subject: [PATCH RT] ipc: add a critical section in pipelined_receive

This patch is for v2.6.33.9-rt31 to avoid a deadlock.
In POSIX message queue, if a sender process uses SCHED_FIFO and 
has a higher priority than a receiver process, the sender will
be stuck at ipc/mqueue.c:446

  445                 while (ewp->state == STATE_PENDING)
  446                         cpu_relax();

Description of the problem
 (receiver process)
   1. receiver changes sender's state to STATE_PENDING (mqueue.c:832)
   2. wake up sender process and "switch to sender" (mqueue.c:833)
      Note: This context switch only happens in PREEMPT_RT kernel.
 (sender process)
   3. sender check the own state in above loop (mqueue.c:445-446)
   *. receiver will never wake up and cannot change sender's state to
      STATE_READY because sender has higher priority


Signed-off-by: Yoshitake Kobayashi <yoshitake.kobayashi@...hiba.co.jp>
---
 ipc/mqueue.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 01582e5..712d813 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -827,12 +827,17 @@ static inline void pipelined_receive(struct mqueue_inode_info *info)
 		wake_up_interruptible(&info->wait_q);
 		return;
 	}
+	/*
+	 * Keep them in one critical section for PREEMPT_RT:
+	 */
+	preempt_disable_rt();
 	msg_insert(sender->msg, info);
 	list_del(&sender->list);
 	sender->state = STATE_PENDING;
 	wake_up_process(sender->task);
 	smp_wmb();
 	sender->state = STATE_READY;
+	preempt_enable_rt();
 }
 
 SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
-- 
1.7.2.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/