linux-kernel - Re: [PATCH 1/4] lockdep: lock_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111108093741.GB4038@zhy>
Date:	Tue, 8 Nov 2011 17:37:41 +0800
From:	Yong Zhang <yong.zhang0@...il.com>
To:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc:	Vegard Nossum <vegard.nossum@...il.com>,
	linux-kernel@...r.kernel.org, sergey.senozhatsky@...il.com,
	bp@...en8.de, Ingo Molnar <mingo@...e.hu>,
	Tejun Heo <tj@...nel.org>,
	David Rientjes <rientjes@...gle.com>,
	casteyde.christian@...e.fr
Subject: Re: [PATCH 1/4] lockdep: lock_set_subclass() fix

On Tue, Nov 08, 2011 at 05:07:35PM +0800, Yong Zhang wrote:
> On Tue, Nov 08, 2011 at 09:46:20AM +0100, Peter Zijlstra wrote:
> > On Tue, 2011-11-08 at 16:14 +0800, Yong Zhang wrote:
> > > 
> > > But how do we deal with ->class_cache? Always set it in
> > > loop_up_lock_class()? 
> > 
> > Hrm.. good point, aside from that there's another problem as well, I
> > think we can deal with the cache being NULL, but is memset() an atomic
> > write? If not a read could observe an intermediate state and go funny.
> 
> Yup.
> 
> > 
> > I'm tempted to go with the pure kmemcheck_mark_initialized() thing for
> > now.
> 
> me too :)
> 
> So something like below?
> 
> Thanks,
> Yong
> ---
> From: Yong Zhang <yong.zhang0@...il.com>
> Subject: [PATCH] lockdep: kmemcheck: annotate ->lock in lockdep_init_map()
> 
> Since commit f59de89 [lockdep: Clear whole lockdep_map on initialization],
> lockdep_init_map() will clear all the struct. But it will break
> lock_set_class()/lock_set_subclass(). A typical race condition
> is like below:
> 
>      CPU A                                   CPU B
> lock_set_subclass(lockA);
>  lock_set_class(lockA);
>    lockdep_init_map(lockA);
>      /* lockA->name is cleared */
>      memset(lockA);
>                                      __lock_acquire(lockA);
>                                        /* lockA->class_cache[] is cleared */
>                                        register_lock_class(lockA);
>                                          look_up_lock_class(lockA);
>                                            WARN_ON_ONCE(class->name !=
>                                                      lock->name);
> 
>      lock->name = name;
> 
> So annotate ->lock with kmemcheck_mark_initialized() to cure this problem
> and the one reported in commit f59de89.
> 
> Reported-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
> Reported-by: Borislav Petkov <bp@...en8.de>
> Suggested-by: Vegard Nossum <vegard.nossum@...il.com>
> Signed-off-by: Yong Zhang <yong.zhang0@...il.com>
> Cc: Peter Zijlstra <a.p.zijlstra@...llo.nl>
> Cc: Ingo Molnar <mingo@...e.hu>
> Cc: Tejun Heo <tj@...nel.org>
> Cc: David Rientjes <rientjes@...gle.com>
> ---
>  kernel/lockdep.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/kernel/lockdep.c b/kernel/lockdep.c
> index e69434b..08a2b1b 100644
> --- a/kernel/lockdep.c
> +++ b/kernel/lockdep.c
> @@ -2948,7 +2948,7 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
>  void lockdep_init_map(struct lockdep_map *lock, const char *name,
>  		      struct lock_class_key *key, int subclass)
>  {
> -	memset(lock, 0, sizeof(*lock));
> +	kmemcheck_mark_initialized(lock, sizeof(*lock));

But for a lock in initializing stage (like spin_lock_init()), we still
need to guarantee that lock->class_cache[] doesn't contain garbage.

Need more thought here.

Thanks,
Yong

>  
>  #ifdef CONFIG_LOCK_STAT
>  	lock->cpu = raw_smp_processor_id();
> -- 
> 1.7.5.4
> 

-- 
Only stand for myself
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/