linux-kernel - Re: [PATCH 1/1] do_exit(): Solve possibility of BUG() due to race with try_to_wake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140902155208.GA28668@redhat.com>
Date:	Tue, 2 Sep 2014 17:52:08 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Peter Zijlstra <peterz@...radead.org>
Cc:	Kautuk Consul <consul.kautuk@...il.com>,
	Ingo Molnar <mingo@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Michal Hocko <mhocko@...e.cz>,
	David Rientjes <rientjes@...gle.com>,
	Ionut Alexa <ionut.m.alexa@...il.com>,
	Guillaume Morin <guillaume@...infr.org>,
	linux-kernel@...r.kernel.org, Kirill Tkhai <tkhai@...dex.ru>
Subject: Re: [PATCH 1/1] do_exit(): Solve possibility of BUG() due to race
	with try_to_wake_up()

On 09/01, Peter Zijlstra wrote:
>
> On Mon, Sep 01, 2014 at 07:58:51PM +0200, Oleg Nesterov wrote:
>
> > However, the very fact that another CPU can look at this task_struct
> > means that we still need spin_unlock_wait(). If nothing else to ensure
> > that try_to_wake_up()->spin_unlock(pi_lock) won't write into the memory
> > we are are going to free.
>
> task_struct is RCU freed, if it still has a 'reference' to the task,

Not really, put_task_struct() frees this memory once the counter is zero,
but this doesn't matter,

> it shouldn't be going 'away', right?

Yes, thanks for correcting me. Somehow I forgot that the caller of ttwu()
should have a reference anyway. And indeed, say, __rwsem_do_wake() does
have. Otherwise this code would be obviously buggy in any case.

> > So I think the comment in do exit should be updated too, and smp_mb()
> > should be moved under raw_spin_unlock_wait() but ...
> >
> > But. If am right, doesn't this mean we that have even more problems with
> > postmortem wakeups??? Why ttwu() can't _start_ after spin_unlock_wait ?
>
> ttwu should bail at: if (!(p->state & state)) goto out; That should
> never match with TASK_DEAD.

See above. I meant another problem, but I was wrong.

OK. So this patch should probably work. But let me think again and send
it tommorrow. Because today (and yesterday) I didn't really sleep ;)

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/