linux-kernel - Re: 2.6.35-rc3 deadlocks on semaphore operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C223657.3030507@colorfullife.com>
Date:	Wed, 23 Jun 2010 18:29:11 +0200
From:	Manfred Spraul <manfred@...orfullife.com>
To:	Luca Tettamanti <kronos.it@...il.com>
CC:	Christoph Lameter <cl@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, Julia Lawall <julia@...u.dk>,
	Andrew Morton <akpm@...ux-foundation.org>,
	maciej.rutecki@...il.com
Subject: Re: 2.6.35-rc3 deadlocks on semaphore operations

Hi,

I think I found it:
Previously, queue.status was never IN_WAKEUP when the semaphore spinlock 
was held.

The last patch changes that:
Now the change from IN_WAKEUP to the final result code happens after the 
the semaphore spinlock is dropped.
Thus a task can observe IN_WAKEUP even when it acquired the semaphore 
spinlock.

As a result, semop() sometimes returned 1 (IN_WAKEUP) for a successful 
operation.

Attached is a patch that should fix the bug.

--
     Manfred

View attachment "0001-ipc-sem.c-Bugfix-for-semop.patch" of type "text/plain" (2499 bytes)