linux-kernel - Re: [PATCH next v2 4/5] locking/osq_lock: Avoid writing to node->next in the osq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 31 Dec 2023 23:13:25 -0500
From: Waiman Long <longman@...hat.com>
To: David Laight <David.Laight@...LAB.COM>,
 "'linux-kernel@...r.kernel.org'" <linux-kernel@...r.kernel.org>,
 "'peterz@...radead.org'" <peterz@...radead.org>
Cc: "'mingo@...hat.com'" <mingo@...hat.com>,
 "'will@...nel.org'" <will@...nel.org>,
 "'boqun.feng@...il.com'" <boqun.feng@...il.com>,
 'Linus Torvalds' <torvalds@...ux-foundation.org>,
 "'virtualization@...ts.linux-foundation.org'"
 <virtualization@...ts.linux-foundation.org>,
 'Zeng Heng' <zengheng4@...wei.com>
Subject: Re: [PATCH next v2 4/5] locking/osq_lock: Avoid writing to node->next
 in the osq_lock() fast path.


On 12/31/23 16:54, David Laight wrote:
> When osq_lock() returns false or osq_unlock() returns static
> analysis shows that node->next should always be NULL.
> This means that it isn't necessary to explicitly set it to NULL
> prior to atomic_xchg(&lock->tail, curr) on extry to osq_lock().
>
> Just in case there a non-obvious race condition that can leave it
> non-NULL check with WARN_ON_ONCE() and NULL if set.
> Note that without this check the fast path (adding at the list head)
> doesn't need to to access the per-cpu osq_node at all.
>
> Signed-off-by: David Laight <david.laight@...lab.com>
> ---
>   kernel/locking/osq_lock.c | 14 ++++++++++----
>   1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c
> index 27324b509f68..35bb99e96697 100644
> --- a/kernel/locking/osq_lock.c
> +++ b/kernel/locking/osq_lock.c
> @@ -87,12 +87,17 @@ osq_wait_next(struct optimistic_spin_queue *lock,
>   
>   bool osq_lock(struct optimistic_spin_queue *lock)
>   {
> -	struct optimistic_spin_node *node = this_cpu_ptr(&osq_node);
> -	struct optimistic_spin_node *prev, *next;
> +	struct optimistic_spin_node *node, *prev, *next;
>   	int curr = encode_cpu(smp_processor_id());
>   	int prev_cpu;
>   
> -	node->next = NULL;
> +	/*
> +	 * node->next should be NULL on entry.
> +	 * Check just in case there is a race somewhere.
> +	 * Note that this is probably an unnecessary cache miss in the fast path.
> +	 */
> +	if (WARN_ON_ONCE(raw_cpu_read(osq_node.next) != NULL))
> +		raw_cpu_write(osq_node.next, NULL);
>   
>   	/*
>   	 * We need both ACQUIRE (pairs with corresponding RELEASE in
> @@ -104,8 +109,9 @@ bool osq_lock(struct optimistic_spin_queue *lock)
>   	if (prev_cpu == OSQ_UNLOCKED_VAL)
>   		return true;
>   
> -	node->prev_cpu = prev_cpu;
> +	node = this_cpu_ptr(&osq_node);
>   	prev = decode_cpu(prev_cpu);
> +	node->prev_cpu = prev_cpu;
>   	node->locked = 0;
>   
>   	/*
Reviewed-by: Waiman Long <longman@...hat.com>