linux-kernel - Re: [listll] Fix fetching of head->first in lockless lists.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Aug 2011 10:25:53 -0500 (CDT)
From:	Christoph Lameter <cl@...ux.com>
To:	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
cc:	Huang Ying <ying.huang@...el.com>, Andi Kleen <ak@...ux.intel.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [listll] Fix fetching of head->first in lockless lists.

On Thu, 4 Aug 2011, Mathieu Desnoyers wrote:

> * Christoph Lameter (cl@...ux.com) wrote:
> >
> > The fetching of head->first must occur in the cmpxchg loop.
> >
> > With the current code head->first may change after the content were assigned to
> > the "entry" variable. Entry then not be change anymore in the loop and be
> > used as old_entry for the cmpxchg. The cmpxchg will then therefore
> > compare "entry" to list->head. This will always fail if list->head has
> > changed. The restarting of the loop will not fetch head->first again. So
> > we could have a hang there.
> >
> > I guess this only works now because the compiler optimizations pull
> > the fetching of head->first into the loop.
>
> Hi Christoph,
>
> The cmpxchg re-fetch the head->first (this is its return value). The:
>
>   } while ((entry = cmpxchg(&head->first, old_entry, new)) != old_entry);
>
> Takes care of the re-read and populating "entry" with an updated value.

I know but that is not the problem.

The code does not refetch the contents in old_entry (which got its value
from entry which was obtained before the loop was entered!). So Old entry
is constant even after a cmpxchg has failed. If head->first has changed
then we will repeatedly comparing the new value to "old_entry" (aka
"entry") as it was before the loop was entered.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/