linux-kernel - RE: [PATCH] klist: del waiter from klist_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <144086DDB7BB6D429C79280EB1C804D409CE3BAC@SHSMSX102.ccr.corp.intel.com>
Date:	Tue, 7 May 2013 08:49:54 +0000
From:	"Zhang, Yanmin" <yanmin.zhang@...el.com>
To:	Peter Zijlstra <peterz@...radead.org>,
	"Wang, Biao" <biao.wang@...el.com>
CC:	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"mingo@...hat.com" <mingo@...hat.com>,
	"mochel@...italimplant.org" <mochel@...italimplant.org>
Subject: RE: [PATCH] klist: del waiter from klist_remove_waiters before
 wakeup waitting process

Andrew,

Would you like to merge the patch to your MM tree?

Yanmin

>-----Original Message-----
>From: Peter Zijlstra [mailto:peterz@...radead.org]
>Sent: Friday, May 03, 2013 6:42 PM
>To: Wang, Biao
>Cc: akpm@...ux-foundation.org; linux-kernel@...r.kernel.org;
>mingo@...hat.com; Zhang, Yanmin; mochel@...italimplant.org
>Subject: Re: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
>waitting process
>
>On Fri, May 03, 2013 at 03:06:36PM +0800, wangbiao wrote:
>> From: "wang, biao" <biao.wang@...el.com>
>> Date: Fri, 3 May 2013 14:18:34 +0800
>> Subject: [PATCH] klist: del waiter from klist_remove_waiters before
>> wakeup  waitting process
>>
>> There is a race between klist_remove and klist_release. klist_remove
>> uses a local var waiter saved on stack. When klist_release calls
>> wake_up_process(waiter->process) to wake up the waiter, waiter might
>> run immediately and reuse the stack. Then, klist_release calls
>> list_del(&waiter->list) to change previous wait data and cause prior
>> waiter thread corrupt.
>>
>> The patch fixes it against kernel 3.9.
>
>
>I've never seen that code before in my life; but after a quick look you appear to
>be completely right.
>
>> Signed-off-by: wang, biao <biao.wang@...el.com>
>
>Acked-by: Peter Zijlstra <a.p.zijlstra@...llo.nl>
>
>> ---
>>  lib/klist.c |    2 +-
>>  1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/lib/klist.c b/lib/klist.c index 0874e41..358a368 100644
>> --- a/lib/klist.c
>> +++ b/lib/klist.c
>> @@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
>>  		if (waiter->node != n)
>>  			continue;
>>
>> +		list_del(&waiter->list);
>>  		waiter->woken = 1;
>>  		mb();
>>  		wake_up_process(waiter->process);
>> -		list_del(&waiter->list);
>>  	}
>>  	spin_unlock(&klist_remove_lock);
>>  	knode_set_klist(n, NULL);
>> --
>> 1.7.6
>>
>>
>>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/