linux-kernel - Thread flags modified without set_thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <45E33EBD.6020603@google.com>
Date:	Mon, 26 Feb 2007 12:10:37 -0800
From:	Mathieu Desnoyers <compudj@...gle.com>
To:	"Martin J. Bligh" <mbligh@...gle.com>, linux-kernel@...r.kernel.org
Subject: Thread flags modified without set_thread_flag() (non atomically)

Hi,

Looking into the thread flags, I found out that some architecture 
specific kernel functions (in 2.6.20) sets the thread flags with non 
atomic operation.

A good way to list the most trivial : grep -r TIF_ * | grep =

Some examples follows. If, for instance, 
x86_64/kernel/process.c:flush_thread is called from an exec system call, 
it will do the following :

x86_64/kernel/process.c:                t->flags ^= (_TIF_ABI_PENDING | 
_TIF_IA32);
x86_64/kernel/process.c:        t->flags &= ~_TIF_DEBUG;

void flush_thread(void)
{
        struct task_struct *tsk = current;
        struct thread_info *t = current_thread_info();

        if (t->flags & _TIF_ABI_PENDING) {
                t->flags ^= (_TIF_ABI_PENDING | _TIF_IA32);
                if (t->flags & _TIF_IA32)
                        current_thread_info()->status |= TS_COMPAT;
        }
        t->flags &= ~_TIF_DEBUG;
....

As long as the flags are only updated by the thread itself at this 
moment, it seems safe, but if other updates coming from other threads 
are expected, wouldn't it result in a bad behavior ?

i.e if resched_task ia being called by another CPU at the same time for 
this specific thread would set the TIF_NEED_RESCHED flag, but it could 
be overwritten by the non-atomic modification in flush_thread.

And about this specific flush_thread, I am puzzled about the t->flags ^= 
(_TIF_ABI_PENDING | _TIF_IA32); line. The XOR will clearly flip the 
_TIF_ABI_PENDING bit to 0, and very likely set _TIF_IA32 to the opposite 
of its current value. Why does this change need to be written atomically 
(can other threads play with these flags ?) ?

Mathieu

Other examples :

sparc64/kernel/ptrace.c:                if 
((task_thread_info(child)->flags & _TIF_32BIT) != 0) {
sparc64/kernel/process.c:               t->flags ^= (_TIF_ABI_PENDING | 
_TIF_32BIT);
sparc64/kernel/process.c:                       t->flags &= ~_TIF_PERFCTR;

sparc/kernel/process.c:         current_thread_info()->flags &= 
~_TIF_USEDFPU;
sparc/kernel/process.c:         current_thread_info()->flags &= 
~_TIF_USEDFPU;
sparc/kernel/process.c:         current_thread_info()->flags &= 
~_TIF_USEDFPU;
sparc/kernel/process.c:                 current_thread_info()->flags &= 
~(_TIF_USEDFPU);
sparc/kernel/traps.c:   current_thread_info()->flags |= _TIF_USEDFPU;
sparc/kernel/traps.c:   task_thread_info(fpt)->flags &= ~_TIF_USEDFPU;

powerpc/kernel/process.c:               t->flags ^= (_TIF_ABI_PENDING | 
_TIF_32BIT);

ia64/kernel/mca.c:      ti->flags = _TIF_MCA_INIT;

avr32/kernel/ptrace.c:          ti->flags |= _TIF_BREAKPOINT;
avr32/kernel/ptrace.c:                  ti->flags |= TIF_SINGLE_STEP;

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/