linux-kernel - Re: [PATCH 6/5] fix the racy usage of thread_group_cputimer() in fastpath_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100611180606.GB13025@redhat.com>
Date:	Fri, 11 Jun 2010 20:06:06 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	Peter Zijlstra <peterz@...radead.org>,
	Stanislaw Gruszka <sgruszka@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6/5] fix the racy usage of thread_group_cputimer() in
	fastpath_timer_check()

On 06/11, Oleg Nesterov wrote:
>
> fastpath_timer_check()->thread_group_cputimer() is racy and
> unneeded.

Just in case... this fix doesn't depend on other patches I sent.

> It is racy because another thread can clear ->running before
> thread_group_cputimer() takes cputimer->lock. In this case
> thread_group_cputimer() will set ->running = true again and call
> thread_group_cputime(). But since we do not hold tasklist or
> siglock, we can race with fork/exit and copy the wrong results
> into cputimer->cputime.
> 
> It is unneeded because if ->running == true we can just use
> the numbers in cputimer->cputime we already have.
> 
> Change fastpath_timer_check() to copy cputimer->cputime into
> the local variable under cputimer->lock. We do not re-check
> ->running under cputimer->lock, run_posix_cpu_timers() does
> this check later.
> 
> Note: we can add more optimizations on top of this change.
> 
> Signed-off-by: Oleg Nesterov <oleg@...hat.com>
> ---
> 
>  kernel/posix-cpu-timers.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> --- 35-rc2/kernel/posix-cpu-timers.c~6_FPTC_DONT_SET_RUNNING	2010-06-11 01:08:03.000000000 +0200
> +++ 35-rc2/kernel/posix-cpu-timers.c	2010-06-11 19:40:22.000000000 +0200
> @@ -1287,7 +1287,10 @@ static inline int fastpath_timer_check(s
>  	if (sig->cputimer.running) {
>  		struct task_cputime group_sample;
>  
> -		thread_group_cputimer(tsk, &group_sample);
> +		spin_lock(&sig->cputimer.lock);
> +		group_sample = sig->cputimer.cputime;
> +		spin_unlock(&sig->cputimer.lock);
> +
>  		if (task_cputime_expired(&group_sample, &sig->cputime_expires))
>  			return 1;
>  	}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/