linux-kernel - [PATCH 1/2] lockdep: kmemcheck: annotate ->lock in lockdep_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111109080451.GB8124@zhy>
Date:	Wed, 9 Nov 2011 16:04:51 +0800
From:	Yong Zhang <yong.zhang0@...il.com>
To:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc:	Vegard Nossum <vegard.nossum@...il.com>,
	linux-kernel@...r.kernel.org, sergey.senozhatsky@...il.com,
	bp@...en8.de, Ingo Molnar <mingo@...e.hu>,
	Tejun Heo <tj@...nel.org>,
	David Rientjes <rientjes@...gle.com>,
	casteyde.christian@...e.fr
Subject: [PATCH 1/2] lockdep: kmemcheck: annotate ->lock in lockdep_init_map()

On Tue, Nov 08, 2011 at 10:40:46AM +0100, Peter Zijlstra wrote:
> On Tue, 2011-11-08 at 17:07 +0800, Yong Zhang wrote:
> > So something like below?
> 
> that fails to clear/init the class_cache, leading to all sorts of
> problems.
> 
> Wiping the class_cache just reduces performance somewhat, not wiping
> them is disastrous since it can results in wild pointer derefs.
> 
> Now we could fix up register_lock_class() to reset the class_cache,
> although that's a little tricky and I'm not sure its worth it.

Yeah, I have done some benchmark which show it's worthful, please
check patch#2.

And below is the one which cure the current problem.

Thanks,
Yong

---
From: Yong Zhang <yong.zhang0@...il.com>
Subject: [PATCH 1/2] lockdep: kmemcheck: annotate ->lock in lockdep_init_map()

Since commit f59de89 [lockdep: Clear whole lockdep_map on initialization],
lockdep_init_map() will clear all the struct. But it will break
lock_set_class()/lock_set_subclass(). A typical race condition
is like below:

     CPU A                                   CPU B
lock_set_subclass(lockA);
 lock_set_class(lockA);
   lockdep_init_map(lockA);
     /* lockA->name is cleared */
     memset(lockA);
                                     __lock_acquire(lockA);
                                       /* lockA->class_cache[] is cleared */
                                       register_lock_class(lockA);
                                         look_up_lock_class(lockA);
                                           WARN_ON_ONCE(class->name !=
                                                     lock->name);

     lock->name = name;

So restore to what we have done before commit f59de89 but annotate
->lock with kmemcheck_mark_initialized() to suppress the kmemcheck
warning reported in commit f59de89.

Reported-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
Reported-by: Borislav Petkov <bp@...en8.de>
Suggested-by: Vegard Nossum <vegard.nossum@...il.com>
Signed-off-by: Yong Zhang <yong.zhang0@...il.com>
Cc: Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc: Ingo Molnar <mingo@...e.hu>
Cc: Tejun Heo <tj@...nel.org>
Cc: David Rientjes <rientjes@...gle.com>
---
 kernel/lockdep.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index e69434b..21ea1dc 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -2948,7 +2948,12 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
 void lockdep_init_map(struct lockdep_map *lock, const char *name,
 		      struct lock_class_key *key, int subclass)
 {
-	memset(lock, 0, sizeof(*lock));
+	int i;
+
+	kmemcheck_mark_initialized(lock, sizeof(*lock));
+
+	for (i = 0; i < NR_LOCKDEP_CACHING_CLASSES; i++)
+		lock->class_cache[i] = NULL;
 
 #ifdef CONFIG_LOCK_STAT
 	lock->cpu = raw_smp_processor_id();
-- 
1.7.5.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/