linux-kernel - Re: PROBLEM: Concurrency issue in sem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 10 Oct 2015 08:50:22 +0200
From:	Manfred Spraul <manfred@...orfullife.com>
To:	Felix Hübner <felixh@...ormatik.uni-bremen.de>,
	linux-kernel@...r.kernel.org
Cc:	bitbucket@...ine.de, riel@...hat.com, dbueso@...e.de,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: PROBLEM: Concurrency issue in sem_lock

Hi,

On 10/09/2015 10:24 AM, Felix Hübner wrote:
> Hi all,
>
> I have just reported a concurrency issue in the implementation of
> sem_lock, see https://bugzilla.kernel.org/show_bug.cgi?id=105651
>
> [...]
> # P0 does spin_lock(&sem->lock); in line 336.
>
> 		spin_lock(&sem->lock);
[...]
> # P2 performs rest of semtimedop, increments complex_count and ends up
> in line 1961 and starts to sleep.
>
> 		return -1;
> 	}
That is the problem: semtimedop() increments complex_count - thus 
sem_wait_array() returns without a spin_unlock_wait() loop - but P0 
already owns spin_lock(&sem->lock).

How do we want to fix it?
- revert my patch (simplify code, but slower for one corner case)
- add the missing sem_wait_array (more complex, but also better for 
complex semops).

what do you think?

(patch untested)

--
     Manfred

View attachment "0001-ipc-sem.c-Alternative-for-fixing-Concurrency-bug.patch" of type "text/x-patch" (1360 bytes)