linux-kernel - Re: [PATCH -next] ipc: make refcounter atomic (was Re: linux-next: Tree for Apr 23 [ Call-Traces: lib/debugobjects.c | kernel/rcupdate.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+icZUXwfvCMhP0BJAcxNNMPuKELxav6QmN0MCfd-swRV+4g=g@mail.gmail.com>
Date:	Thu, 25 Apr 2013 01:48:21 +0200
From:	Sedat Dilek <sedat.dilek@...il.com>
To:	Davidlohr Bueso <davidlohr.bueso@...com>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Rik van Riel <riel@...riel.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Paul McKenney <paulmck@...ux.vnet.ibm.com>,
	Paul McKenney <paul.mckenney@...aro.org>,
	Emmanuel Benisty <benisty.e@...il.com>,
	linux-next <linux-next@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH -next] ipc: make refcounter atomic (was Re: linux-next:
 Tree for Apr 23 [ Call-Traces: lib/debugobjects.c | kernel/rcupdate.c |
 kernel/rcutree.c ])

On Thu, Apr 25, 2013 at 1:38 AM, Davidlohr Bueso <davidlohr.bueso@...com> wrote:
> On Thu, 2013-04-25 at 01:05 +0200, Sedat Dilek wrote:
>> On Thu, Apr 25, 2013 at 12:16 AM, Davidlohr Bueso
>> <davidlohr.bueso@...com> wrote:
>> > From: Davidlohr Bueso <davidlohr.bueso@...com>
>> >
>> > Sedat reported an issue leading to a NULL dereference in update_queue():
>> >
>> > [  178.490583] BUG: spinlock bad magic on CPU#1, sh/8066
>> > [  178.490595]  lock: 0xffff88008b53ea18, .magic: 6b6b6b6b, .owner: make/8068, .owner_cpu: 3
>> > [  178.490599] BUG: unable to handle kernel NULL pointer dereference at           (null)
>> > [  178.490608] IP: [<ffffffff812bacd0>] update_queue+0x70/0x210
>> > [  178.490610] PGD 0
>> > [  178.490612] Oops: 0000 [#1] SMP
>> > ...
>> > [  178.490704] Call Trace:
>> > [  178.490710]  [<ffffffff812baf51>] do_smart_update+0xe1/0x140
>> > [  178.490713]  [<ffffffff812bd6e1>] exit_sem+0x2b1/0x350
>> > [  178.490718]  [<ffffffff8105de80>] do_exit+0x290/0xa70
>> > [  178.490721]  [<ffffffff8105e6f4>] do_group_exit+0x44/0xa0
>> > [  178.490724]  [<ffffffff8105e767>] SyS_exit_group+0x17/0x20
>> > [  178.490728]  [<ffffffff816ce15d>] system_call_fastpath+0x1a/0x1f
>> >
>> > Linus pin-pointed the problem to a race in the reference counter. To quote:
>> >
>> > "That dmesg spew very much implies that the same RCU head got added twice to the RCU
>> > freeing list, and the only way that happens is if the refcount goes to
>> > zero twice. Which implies that either we increment a zero, or we lack
>> > locking and the coherency of the non-atomic access goes away."
>> >
>> > This patch converts the IPC RCU header's reference counter to atomic_t. The return of
>> > ipc_rcu_getref() is modified to inform the callers if it actually succeeded.
>> >
>> > Now all callers return -EIDRM upon failure and abort the current operation. Two exceptions are
>> > in semaphore code where sem_getref_and_unlock() and sem_getref() trigger a warning but proceed
>> > to freeing up any held locks.
>> >
>> > Signed-off-by: Davidlohr Bueso <davidlohr.bueso@...com>
>> > Suggested-by: Linus Torvalds <torvalds@...ux-foundation.org>
>> > CC: Rik van Riel <riel@...riel.com>
>> > CC: Paul McKenney <paul.mckenney@...aro.org>
>> > CC: Sedat Dilek <sedat.dilek@...il.com>
>> > CC: Emmanuel Benisty <benisty.e@...il.com>
>> > CC: Andrew Morton <akpm@...ux-foundation.org>
>>
>> Missing my Reported-by ...!
>
> Not trying to take away credit or efforts from you, just wanted you to
> reconfirm that *this* actual patch fixes things for you :)
>

No, I am not of those "bad guys" in OSS.
I would not have invested so much time in helping to get this fixed.

Did my usual test-case:
A kernel-rebuild within same kernel-environment with no breakage or
abnormalities in the logs.

Hope I could help.

- Sedat -

> Thanks,
> Davidlohr
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/