linux-kernel - Re: [BUG][tip/master] kernel panic while locking selftest at qspinlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 10 Jul 2015 16:28:24 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Ingo Molnar <mingo@...nel.org>
Cc:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Ingo Molnar <mingo@...e.hu>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	Waiman Long <Waiman.Long@...com>
Subject: Re: [BUG][tip/master] kernel panic while locking selftest at
 qspinlock_paravirt.h:137!

On Fri, Jul 10, 2015 at 03:57:46PM +0200, Ingo Molnar wrote:
> * Peter Zijlstra <peterz@...radead.org> wrote:

> > Do we want to make double unlock non-fatal unconditionally?
> 
> No, just don't BUG() out, don't crash the system - generate a warning?

So that would be a yes..

Something like so then? Won't this generate a splat on that locking self
test then? And upset people?

---
 kernel/locking/qspinlock_paravirt.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/kernel/locking/qspinlock_paravirt.h b/kernel/locking/qspinlock_paravirt.h
index 04ab18151cc8..286e8978a562 100644
--- a/kernel/locking/qspinlock_paravirt.h
+++ b/kernel/locking/qspinlock_paravirt.h
@@ -133,8 +133,14 @@ static struct pv_node *pv_unhash(struct qspinlock *lock)
 	 * This guarantees a limited lookup time and is itself guaranteed by
 	 * having the lock owner do the unhash -- IFF the unlock sees the
 	 * SLOW flag, there MUST be a hash entry.
+	 *
+	 * This can trigger due to double-unlock. In which case, return a
+	 * random pointer so that __pv_queued_spin_unlock() can dereference it
+	 * without crashing.
 	 */
-	BUG();
+	WARN_ON_ONCE(true);
+
+	return (struct pv_node *)this_cpu_ptr(&mcs_nodes[0]);
 }
 
 /*
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/