linux-kernel - RE: [PATCH v2] rcu: fix a race in hlist_nulls_for_each_entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AE90C24D6B3A694183C094C60CF0A2F6026B7247@saturn3.aculab.com>
Date:	Wed, 22 May 2013 15:23:19 +0100
From:	"David Laight" <David.Laight@...LAB.COM>
To:	"Eric Dumazet" <eric.dumazet@...il.com>
Cc:	"Roman Gushchin" <klamm@...dex-team.ru>,
	<paulmck@...ux.vnet.ibm.com>,
	"Dipankar Sarma" <dipankar@...ibm.com>, <zhmurov@...dex-team.ru>,
	<linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
	"David S. Miller" <davem@...emloft.net>,
	"Alexey Kuznetsov" <kuznet@....inr.ac.ru>,
	"James Morris" <jmorris@...ei.org>,
	"Hideaki YOSHIFUJI" <yoshfuji@...ux-ipv6.org>,
	"Patrick McHardy" <kaber@...sh.net>
Subject: RE: [PATCH v2] rcu: fix a race in hlist_nulls_for_each_entry_rcu macro

> Here this loops begin by
> 
>  someptr = rcu_dereference(somelocation);
> 
> May claim is rcu_dereference() should force the compiler to read again
> somelocation. Its done thanks to ACCESS_ONCE(). But apparently in the
> specific case of &hslot->head, it doesnt work.

Hmmm....
#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
That might be doomed to fail for much the same reason as:
void x(struct foo *unaligned_ptr)
{
    char *p = (void *)unaligned_ptr;
    memcpy(tgt, p, sizeof *p);
}
generates alignment faults.
And that casts to a union type don't get around 'strict aliasing'.

Basically the compiler makes use of the fact that you should
cast addresses back to their original type before dereferencing them.

So I'm not sure you can use a cast to add a type qualifier.
The front-end lets you remove 'const', but I suspect the optimiser
is using the original types.

	David