linux-kernel - Re: sched: memory corruption on completing completions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 05 Feb 2015 15:44:35 -0500
From:	Sasha Levin <sasha.levin@...cle.com>
To:	Peter Zijlstra <peterz@...radead.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
CC:	Waiman Long <Waiman.Long@...com>, Ingo Molnar <mingo@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Andrey Ryabinin <a.ryabinin@...sung.com>,
	Dave Jones <davej@...emonkey.org.uk>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: sched: memory corruption on completing completions

On 02/05/2015 04:30 AM, Peter Zijlstra wrote:
> On Wed, Feb 04, 2015 at 04:16:54PM -0800, Linus Torvalds wrote:
>> > Why did I think we had this bug but already fixed it ? Maybe it's one
>> > of those things that Waiman fixed in his long delayed qspinlock
>> > series? Waiman? 
> ISTR that that would do the exact same thing, but I need to go look a
> the latest paravirt code -- that's the part that we all were still
> bothered with.

Testing Linus's explanation, I tried simply:


diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index 7050d86..54454da 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -142,7 +142,7 @@ static inline void __ticket_unlock_slowpath(arch_spinlock_t *lock,
                __ticket_unlock_kick(lock, old.tickets.head);
        }
 }
-
+static inline int arch_spin_is_locked(arch_spinlock_t *lock);
 static __always_inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
        if (TICKET_SLOWPATH_FLAG &&
@@ -153,7 +153,7 @@ static __always_inline void arch_spin_unlock(arch_spinlock_t *lock)
                add_smp(&lock->tickets.head, TICKET_LOCK_INC);

                /* add_smp() is a full mb() */
-
+               WARN_ON(arch_spin_is_locked(lock));
                if (unlikely(lock->tickets.tail & TICKET_SLOWPATH_FLAG))
                        __ticket_unlock_slowpath(lock, prev);
        } else


And the warnings confirmed that the lock is indeed "unlocked" before we finished
arch_spin_unlock()...


Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/