linux-kernel - [GIT PULL] percpu fixes for v3.18-rc5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20141123174807.GA22488@htj.dyndns.org>
Date:	Sun, 23 Nov 2014 12:48:07 -0500
From:	Tejun Heo <tj@...nel.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	linux-kernel@...r.kernel.org, Kent Overstreet <kmo@...erainc.com>,
	Christoph Lameter <cl@...ux-foundation.org>,
	Shaohua Li <shli@...nel.org>
Subject: [GIT PULL] percpu fixes for v3.18-rc5

Hello, Linus.

This pull request contains one patch to fix a race condition which can
lead to percpu_ref using a percpu pointer which is corrupted with a
set DEAD bit.  The bug was introduced while separating out the ATOMIC
mode flag from the DEAD flag.  The fix is pretty straight forward.

I just committed the patch to the percpu tree but am sending out the
pull request early as I'll be on vacation for a week.  The patch
should be fairly safe and while the latency will be higher I'll be
checking emails.

Thanks.

The following changes since commit cac7f2429872d3733dc3f9915857b1691da2eb2f:

  Linux 3.18-rc2 (2014-10-26 16:48:41 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu.git for-3.18-fixes

for you to fetch changes up to 4aab3b5b3ccf94fc907e66233e6ca4d8675759a6:

  percpu-ref: fix DEAD flag contamination of percpu pointer (2014-11-23 12:36:06 -0500)

----------------------------------------------------------------
Tejun Heo (1):
      percpu-ref: fix DEAD flag contamination of percpu pointer

 include/linux/percpu-refcount.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index d5c89e0..51ce60c 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -133,7 +133,13 @@ static inline bool __ref_is_percpu(struct percpu_ref *ref,
 	/* paired with smp_store_release() in percpu_ref_reinit() */
 	smp_read_barrier_depends();
 
-	if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC))
+	/*
+	 * Theoretically, the following could test just ATOMIC; however,
+	 * then we'd have to mask off DEAD separately as DEAD may be
+	 * visible without ATOMIC if we race with percpu_ref_kill().  DEAD
+	 * implies ATOMIC anyway.  Test them together.
+	 */
+	if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC_DEAD))
 		return false;
 
 	*percpu_countp = (unsigned long __percpu *)percpu_ptr;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/