linux-kernel - add_wait_queue() (unintentional?) behavior change in v4.13

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Nov 2017 16:58:28 -0800
From:   Omar Sandoval <osandov@...ndov.com>
To:     Ingo Molnar <mingo@...nel.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-kernel@...r.kernel.org, Jens Axboe <axboe@...com>
Subject: add_wait_queue() (unintentional?) behavior change in v4.13

Hi, Ingo,

Commit 50816c48997a ("sched/wait: Standardize internal naming of
wait-queue entries") changed the behavior of add_wait_queue() from
inserting the wait entry at the head of the wait queue to the tail of
the wait queue. This is the relevant hunk:

-void add_wait_queue(wait_queue_head_t *q, wait_queue_entry_t *wait)
+void add_wait_queue(wait_queue_head_t *q, struct wait_queue_entry *wq_entry)
 {
        unsigned long flags;

-       wait->flags &= ~WQ_FLAG_EXCLUSIVE;
+       wq_entry->flags &= ~WQ_FLAG_EXCLUSIVE;
        spin_lock_irqsave(&q->lock, flags);
-       __add_wait_queue(q, wait);
+       __add_wait_queue_entry_tail(q, wq_entry);
        spin_unlock_irqrestore(&q->lock, flags);
 }
 EXPORT_SYMBOL(add_wait_queue);

Note the change from __add_wait_queue() to
__add_wait_queue_entry_tail(). I'm assuming this was a typo since the
commit message doesn't mention any functional changes. This patch
restores the old behavior:

diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 98feab7933c7..929ecb7d6b78 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -27,7 +27,7 @@ void add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq

 	wq_entry->flags &= ~WQ_FLAG_EXCLUSIVE;
 	spin_lock_irqsave(&wq_head->lock, flags);
-	__add_wait_queue_entry_tail(wq_head, wq_entry);
+	__add_wait_queue(wq_head, wq_entry);
 	spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(add_wait_queue);

I didn't go through and audit callers of add_wait_queue(), but from a
quick code read this makes it so that non-exclusive waiters will not be
woken up if they are behind enough exclusive waiters, and I bet that'll
cause some bugs.