linux-kernel - Re: [PATCH 2.6.29.x - 2.6.31.1] module: fix __module_ref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 29 Mar 2010 16:09:46 -0400
From:	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To:	Steven Rostedt <rostedt@...dmis.org>
Cc:	Randy Dunlap <randy.dunlap@...cle.com>,
	Eric Dumazet <dada1@...mosbay.com>,
	Rusty Russell <rusty@...tcorp.com.au>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Tejun Heo <tj@...nel.org>, Ingo Molnar <mingo@...e.hu>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Greg Kroah-Hartman <gregkh@...e.de>,
	linux-kernel@...r.kernel.org, stable <stable@...nel.org>
Subject: Re: [PATCH 2.6.29.x - 2.6.31.1] module: fix __module_ref_addr()

* Steven Rostedt (rostedt@...dmis.org) wrote:
> This patch does not apply to 2.6.34-rc, and the code in upstream looks
> to have been fixed. Should this go to stable?

Yes. 2.6.34-rc does not have this issue anymore, but the patch is needed in
-stable.

Thanks,

Mathieu

> 
> -- Steve
> 
> 
> On Sat, 2010-03-27 at 10:31 -0400, Mathieu Desnoyers wrote:
> > __module_ref_addr() should use per_cpu_ptr() to obfuscate the pointer
> > (RELOC_HIDE is needed for per cpu pointers).
> > 
> > This non-standard per-cpu pointer use has been introduced by commit
> > 720eba31f47aeade8ec130ca7f4353223c49170f
> > 
> > It causes a NULL pointer exception on some configurations when CONFIG_TRACING is
> > enabled on 2.6.33. This patch fixes the problem (acknowledged by Randy who
> > reported the bug).
> > 
> > It did not appear to hurt previously because most of the accesses were done
> > through local_inc, which probably obfuscated the access enough that no compiler
> > optimizations were done. But with local_read() done when CONFIG_TRACING is
> > active, this becomes a problem. Non-CONFIG_TRACING is probably affected as well
> > (module.c contains local_set and local_read that use __module_ref_addr()), but I
> > guess nobody noticed because we've been lucky enough that the compiler did not
> > generate the inappropriate optimization pattern there.
> > 
> > This patch should be queued for the 2.6.29.x through 2.6.33.x stable branches.
> > (tested on 2.6.33.1 x86_64)
> > 
> > The __module_ref_addr() problem disappears in 2.6.34-rc kernels because these
> > percpu accesses were re-factored.
> > 
> > It makes me wonder about other non-standard uses of per_cpu_offset: there is one
> > in module.c and two in lockdep.c, which are still in 2.6.34-rc. This should
> > probably be fixed by the code authors in separate patches.
> > 
> > lockdep.c: commit 8e18257d29238311e82085152741f0c3aa18b74d
> > module.c: commit 6b588c18f8dacfa6d7957c33c5ff832096e752d3
> > 
> > Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
> > Tested-by: Randy Dunlap <randy.dunlap@...cle.com>
> > CC: Eric Dumazet <dada1@...mosbay.com>
> > CC: Rusty Russell <rusty@...tcorp.com.au>
> > CC: Peter Zijlstra <a.p.zijlstra@...llo.nl>
> > CC: Tejun Heo <tj@...nel.org>
> > CC: Ingo Molnar <mingo@...e.hu>
> > CC: Andrew Morton <akpm@...ux-foundation.org>
> > CC: Linus Torvalds <torvalds@...ux-foundation.org>
> > CC: Greg Kroah-Hartman <gregkh@...e.de>
> > CC: Steven Rostedt <rostedt@...dmis.org>
> > ---
> >  include/linux/module.h |    2 +-
> >  kernel/module.c        |    2 +-
> >  2 files changed, 2 insertions(+), 2 deletions(-)
> > 
> > Index: linux-2.6-lttng/include/linux/module.h
> > ===================================================================
> > --- linux-2.6-lttng.orig/include/linux/module.h	2010-03-25 11:01:53.000000000 -0400
> > +++ linux-2.6-lttng/include/linux/module.h	2010-03-25 11:01:59.000000000 -0400
> > @@ -467,7 +467,7 @@ void symbol_put_addr(void *addr);
> >  static inline local_t *__module_ref_addr(struct module *mod, int cpu)
> >  {
> >  #ifdef CONFIG_SMP
> > -	return (local_t *) (mod->refptr + per_cpu_offset(cpu));
> > +	return (local_t *) per_cpu_ptr(mod->refptr, cpu);
> >  #else
> >  	return &mod->ref;
> >  #endif
> > 
> 
> 

-- 
Mathieu Desnoyers
Operating System Efficiency R&D Consultant
EfficiOS Inc.
http://www.efficios.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/