linux-kernel - Re: [GIT pull] genirq fixes for 2.6.31

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.00.0908132219070.1283@localhost.localdomain>
Date:	Thu, 13 Aug 2009 22:24:56 +0200 (CEST)
From:	Thomas Gleixner <tglx@...utronix.de>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
cc:	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>, Ingo Molnar <mingo@...e.hu>
Subject: Re: [GIT pull] genirq fixes for 2.6.31

On Thu, 13 Aug 2009, Linus Torvalds wrote:
> On Thu, 13 Aug 2009, Thomas Gleixner wrote:
> > What guarantees that the compiler does not dereference action->thread
> > twice and the action->thread = NULL; operation happens between the
> > check and the wake_up_process() call? I might be paranoid, but ...
> 
> Aren't we holding the lock here?

No, we don't. The lock is dropped before handle_IRQ_event() is called.
 
> And if we are _not_ holding the lock, then it's racy anyway, and the right 
> fix is the other one I suggested:
> 
> > > Or, alternatively, just move all the "clear action->thread" in free_irq() 
> > > to after having done the "synchronize_irq()" thing, and then - afaik - 
> > > you'll not need that test at all, because you're guaranteed that as long 
> > > as you're in an interrupt handler, the thing shouldn't be cleared.
> > 
> > Right, I looked at that as well, but we need to do it different than
> > just calling synchronize_irq(), as we need to keep desc->lock after we
> > established that no interrupt is in progress. Otherwise we can run
> > into the same problem which we have right now. Patch below.
> 
> But we already _do_ call synchronize_irq().
> 
> And no, we'd better not be running into the same problem, becaue dang it, 
> if we do, then 'action' itself is unreliable (since we'll be doing a 
> 'kfree()' in it in free_irq())

action->thread is the thing which became unreliable due to setting it
to NULL. Yes, I did not think about the fact that we can remove the
action while the interrupt is in progress on another CPU. So setting
action->thread to NULL _before_ calling synchronize_irq() is the cause
for the oops which has been reported.
 
> IOW, why not just make the patch do something like the appended? 
> 
> NOTE! This is UNTESTED. And I also - on purpose - removed the "set 
> action->thread to NULL", because we're going to free 'action', so if 
> anything depends on it, it's already buggy.

Works fine with my test case.

> What am I missing?

Nothing, as far as I can tell.

Acked-by-me.

	tglx

> 
> ---
>  kernel/irq/manage.c |   17 ++++++++---------
>  1 files changed, 8 insertions(+), 9 deletions(-)
> 
> diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
> index 61c679d..0747f22 100644
> --- a/kernel/irq/manage.c
> +++ b/kernel/irq/manage.c
> @@ -809,9 +809,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
>  			desc->chip->disable(irq);
>  	}
>  
> -	irqthread = action->thread;
> -	action->thread = NULL;
> -
>  	spin_unlock_irqrestore(&desc->lock, flags);
>  
>  	unregister_handler_proc(irq, action);
> @@ -819,12 +816,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
>  	/* Make sure it's not being used on another CPU: */
>  	synchronize_irq(irq);
>  
> -	if (irqthread) {
> -		if (!test_bit(IRQTF_DIED, &action->thread_flags))
> -			kthread_stop(irqthread);
> -		put_task_struct(irqthread);
> -	}
> -
>  #ifdef CONFIG_DEBUG_SHIRQ
>  	/*
>  	 * It's a shared IRQ -- the driver ought to be prepared for an IRQ
> @@ -840,6 +831,14 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
>  		local_irq_restore(flags);
>  	}
>  #endif
> +
> +	irqthread = action->thread;
> +	if (irqthread) {
> +		if (!test_bit(IRQTF_DIED, &action->thread_flags))
> +			kthread_stop(irqthread);
> +		put_task_struct(irqthread);
> +	}
> +
>  	return action;
>  }
>  
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/