linux-kernel - Re: Confused by smp_read_barrier_depends() in rxrpc_rotate_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <27030.1212488391@redhat.com>
Date:	Tue, 03 Jun 2008 11:19:51 +0100
From:	David Howells <dhowells@...hat.com>
To:	paulmck@...ux.vnet.ibm.com
Cc:	dhowells@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: Confused by smp_read_barrier_depends() in rxrpc_rotate_tx_window()

Paul E. McKenney <paulmck@...ux.vnet.ibm.com> wrote:

> I confess to being confused by the smp_read_barrier_depends() in
> rxrpc_rotate_tx_window().  It looks like it is ordering the prior
> fetch of tail from call->acks_tail with the subsequent use of

No.  call->acks_head vs [tail].

> tail as an index into the call->acks_window[] array, but then the
> code does an assignment to call->acks_tail a few lines later.
> 
> If we hold a lock protecting call->acks_tail, why do we need the
> smp_read_barrier_depends()?  If we don't hold such a lock, why
> is the assignment to call->acks_tail safe?

We don't hold a lock protecting call->acks_tail.  The head insertion and the
tail extraction are only protected by memory barriers.

	int tail = call->acks_tail, old_tail;
	int win = CIRC_CNT(call->acks_head, tail, call->acks_winsz);
	...
		smp_read_barrier_depends();
		_skb = call->acks_window[tail] & ~1;

In this bit of code, we must protect against seeing the item at '[tail]' set
after 'call->acks_head' itself is updated, hence why we need a barrier here.
Possibly it should be smp_rmb() rather than smp_read_barrier_depends().

		_skb = call->acks_window[tail] & ~1;
		...
		old_tail = tail;
		tail = (tail + 1) & (call->acks_winsz - 1);
		call->acks_tail = tail;

I believe this does not require a barrier between reading '[tail]' and updating
'tail' because there's no way we can update tail without first reading
'[tail]'.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/