lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 30 Sep 2013 11:09:53 +0100 From: Luis Henriques <luis.henriques@...onical.com> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org, kernel-team@...ts.ubuntu.com Cc: Tejun Heo <tj@...nel.org>, Dipankar Sarma <dipankar@...ibm.com>, "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>, "David S. Miller" <davem@...emloft.net>, Li Zefan <lizefan@...wei.com>, Patrick McHardy <kaber@...sh.net>, Luis Henriques <luis.henriques@...onical.com> Subject: [PATCH 016/104] rculist: list_first_or_null_rcu() should use list_entry_rcu() 3.5.7.22 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@...nel.org> commit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream. list_first_or_null() should test whether the list is empty and return pointer to the first entry if not in a RCU safe manner. It's broken in several ways. * It compares __kernel @__ptr with __rcu @__next triggering the following sparse warning. net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces) * It doesn't perform rcu_dereference*() and computes the entry address using container_of() directly from the __rcu pointer which is inconsitent with other rculist interface. As a result, all three in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They dereference the pointer w/o going through read barrier. * While ->next dereference passes through list_next_rcu(), the compiler is still free to fetch ->next more than once and thus nullify the "__ptr != __next" condition check. Fix it by making list_first_or_null_rcu() dereference ->next directly using ACCESS_ONCE() and then use list_entry_rcu() on it like other rculist accessors. v2: Paul pointed out that the compiler may fetch the pointer more than once nullifying the condition check. ACCESS_ONCE() added on ->next dereference. v3: Restored () around macro param which was accidentally removed. Spotted by Paul. Signed-off-by: Tejun Heo <tj@...nel.org> Reported-by: Fengguang Wu <fengguang.wu@...el.com> Cc: Dipankar Sarma <dipankar@...ibm.com> Cc: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com> Cc: "David S. Miller" <davem@...emloft.net> Cc: Li Zefan <lizefan@...wei.com> Cc: Patrick McHardy <kaber@...sh.net> Signed-off-by: Paul E. McKenney <paulmck@...ux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@...htriplett.org> Signed-off-by: Luis Henriques <luis.henriques@...onical.com> --- include/linux/rculist.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/include/linux/rculist.h b/include/linux/rculist.h index e0f0fab..bbea697 100644 --- a/include/linux/rculist.h +++ b/include/linux/rculist.h @@ -267,8 +267,9 @@ static inline void list_splice_init_rcu(struct list_head *list, */ #define list_first_or_null_rcu(ptr, type, member) \ ({struct list_head *__ptr = (ptr); \ - struct list_head __rcu *__next = list_next_rcu(__ptr); \ - likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \ + struct list_head *__next = ACCESS_ONCE(__ptr->next); \ + likely(__ptr != __next) ? \ + list_entry_rcu(__next, type, member) : NULL; \ }) /** -- 1.8.3.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists