linux-kernel - racy jump label users

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130322195551.GQ19692@tassilo.jf.intel.com>
Date:	Fri, 22 Mar 2013 12:55:51 -0700
From:	Andi Kleen <ak@...ux.intel.com>
To:	jbaron@...hat.com
Cc:	linux-kernel@...r.kernel.org
Subject: racy jump label users

Jason,

I noticed that a lot of the jump label users are racy,
because they implement something like this

static void sched_feat_disable(int i)
{
        if (static_key_enabled(&sched_feat_keys[i]))
                static_key_slow_dec(&sched_feat_keys[i]);
}

static void sched_feat_enable(int i)
{
        if (!static_key_enabled(&sched_feat_keys[i]))
                static_key_slow_inc(&sched_feat_keys[i]);
}

with no extra locking, controlled by sysfs. If two
CPUs do this in parallel the reference can be set multiple
times, which gives very unexpected semantics for a sysfs boolean.

Most likely you need a static_key_slow_setstate()
that does the check and set inside the jump label lock.

I understand that for inside kernel use reference
counts are the right semantics, but they are not so
good for sysfs interfaces.

-Andi

-- 
ak@...ux.intel.com -- Speaking for myself only
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/