linux-kernel - [listll] Fix fetching of head->first in lockless lists.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Aug 2011 09:45:32 -0500 (CDT)
From:	Christoph Lameter <cl@...ux.com>
To:	Huang Ying <ying.huang@...el.com>
cc:	Andi Kleen <ak@...ux.intel.com>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	linux-kernel@...r.kernel.org
Subject: [listll] Fix fetching of head->first in lockless lists.


The fetching of head->first must occur in the cmpxchg loop.

With the current code head->first may change after the content were assigned to
the "entry" variable. Entry then not be change anymore in the loop and be
used as old_entry for the cmpxchg. The cmpxchg will then therefore
compare "entry" to list->head. This will always fail if list->head has
changed. The restarting of the loop will not fetch head->first again. So
we could have a hang there.

I guess this only works now because the compiler optimizations pull
the fetching of head->first into the loop.

Signed-off-by: Christoph Lameter <cl@...ux.com>

---
 lib/llist.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Index: linux-2.6/lib/llist.c
===================================================================
--- linux-2.6.orig/lib/llist.c	2011-08-04 09:34:30.000000000 -0500
+++ linux-2.6/lib/llist.c	2011-08-04 09:35:08.000000000 -0500
@@ -42,8 +42,8 @@ void llist_add(struct llist_node *new, s
 	BUG_ON(in_nmi());
 #endif

-	entry = head->first;
 	do {
+		entry = head->first;
 		old_entry = entry;
 		new->next = entry;
 		cpu_relax();
@@ -66,8 +66,8 @@ void llist_add_batch(struct llist_node *
 	BUG_ON(in_nmi());
 #endif

-	entry = head->first;
 	do {
+		entry = head->first;
 		old_entry = entry;
 		new_last->next = entry;
 		cpu_relax();
@@ -97,8 +97,8 @@ struct llist_node *llist_del_first(struc
 	BUG_ON(in_nmi());
 #endif

-	entry = head->first;
 	do {
+		entry = head->first;
 		if (entry == NULL)
 			return NULL;
 		old_entry = entry;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/