linux-kernel - Re: Using sparse to catch invalid RCU dereferences?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080408155259.GA8381@linux.vnet.ibm.com>
Date:	Tue, 8 Apr 2008 08:52:59 -0700
From:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
To:	Johannes Berg <johannes@...solutions.net>
Cc:	Linux Kernel list <linux-kernel@...r.kernel.org>,
	linux-sparse <linux-sparse@...r.kernel.org>
Subject: Re: Using sparse to catch invalid RCU dereferences?

On Tue, Apr 08, 2008 at 12:04:16AM +0200, Johannes Berg wrote:
> Hi,
> 
> Just a thought, I haven't tried this yet because I'm not entirely sure
> it's actually correct. I was just thinking it should be possible to
> introduce something like
> 
> 	#define __rcu	__attribute__((address_space(3)))
> 
> (for sparse only, of course) and then be able to say
> 
> 	struct myfoo *foo __rcu;
> 
> and sparse would warn on
> 
> 	struct myfoo *bar = foo;
> 
> but not on
> 
> 	struct myfoo *bar = rcu_dereference(foo);

Ah, "address_space" is a sparse-ism, no wonder I couldn't find it in
the gcc docs...

So the address_space attribute says what the pointer points to rather
than where the pointer resides, correct?

> by way of using __force inside rcu_dereference(), rcu_assign_pointer()
> etc.
> 
> Would this be feasible? Or should one actually use __bitwise/__force to
> also get the warning when assigning between two variables both marked
> __rcu?

It might be.  There are a number of places where it is legal to access
RCU-protected pointers directly, and all of these would need to be
changed.  For example, in the example above, one could do:

	foo = NULL;

I recently tried to modify rcu_assign_pointer() to issue the memory
memory barrier only when the pointer was non-NULL, but this ended badly.
Probably because I am not the greatest gcc expert around...  We ended
up having to define an rcu_assign_index() to handle the possibility of
assigning a zero-value array index, but my attempts to do type-checking
backfired, and I eventually gave it up.  Again, someone a bit more clued
in to gcc than I am could probably pull it off.

In addition, it is legal to omit rcu_dereference() and rcu_assign_pointer()
when holding the update-side lock.

So I very much like this approach in general, but it will require some
care to implement.  I would be very happy to review and comment!!!

							Thanx, Paul
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/