linux-kernel - Re: [tip:locking/core] locking/rwsem: Fix lock optimistic spinning when owner is not running

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150307171347.GA30365@redhat.com>
Date:	Sat, 7 Mar 2015 18:13:47 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Peter Zijlstra <peterz@...radead.org>
Cc:	linux-tip-commits@...r.kernel.org, dave@...olabs.net,
	hpa@...or.com, sasha.levin@...cle.com, tglx@...utronix.de,
	linux-kernel@...r.kernel.org, jason.low2@...com, walken@...gle.com,
	akpm@...ux-foundation.org, mingo@...nel.org,
	paulmck@...ux.vnet.ibm.com, davej@...emonkey.org.uk,
	ming.lei@...onical.com, peterz@...radead.org,
	torvalds@...ux-foundation.org, tim.c.chen@...ux.intel.com
Subject: Re: [tip:locking/core] locking/rwsem: Fix lock optimistic spinning
	when owner is not running

I think the patch is fine, but this reminds me...

On 03/07, tip-bot for Jason Low wrote:
>
>  bool rwsem_spin_on_owner(struct rw_semaphore *sem, struct task_struct *owner)
>  {
>  	long count;
>
>  	rcu_read_lock();
> -	while (owner_running(sem, owner)) {
> -		/* abort spinning when need_resched */
> -		if (need_resched()) {
> +	while (sem->owner == owner) {
> +		/*
> +		 * Ensure we emit the owner->on_cpu, dereference _after_
> +		 * checking sem->owner still matches owner, if that fails,
> +		 * owner might point to free()d memory, if it still matches,
> +		 * the rcu_read_lock() ensures the memory stays valid.
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Yes, this is another case when we wrongly assume this.

Peter, should I resend

	[PATCH 3/3] introduce task_rcu_dereference()
	http://marc.info/?l=linux-kernel&m=141443631413914

? or should we add another call_rcu() in finish_task_switch() (like -rt does)
to make this true?

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/