linux-kernel - Re: [tip:locking/core] locking/rwsem: Fix lock optimistic spinning when owner is not running

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 10 Mar 2015 11:59:39 +0100
From:	Peter Zijlstra <peterz@...radead.org>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	linux-tip-commits@...r.kernel.org, dave@...olabs.net,
	hpa@...or.com, sasha.levin@...cle.com, tglx@...utronix.de,
	linux-kernel@...r.kernel.org, jason.low2@...com, walken@...gle.com,
	akpm@...ux-foundation.org, mingo@...nel.org,
	paulmck@...ux.vnet.ibm.com, davej@...emonkey.org.uk,
	ming.lei@...onical.com, torvalds@...ux-foundation.org,
	tim.c.chen@...ux.intel.com
Subject: Re: [tip:locking/core] locking/rwsem: Fix lock optimistic spinning
 when owner is not running

On Sat, Mar 07, 2015 at 06:13:47PM +0100, Oleg Nesterov wrote:
> I think the patch is fine, but this reminds me...
> 
> On 03/07, tip-bot for Jason Low wrote:
> >
> >  bool rwsem_spin_on_owner(struct rw_semaphore *sem, struct task_struct *owner)
> >  {
> >  	long count;
> >
> >  	rcu_read_lock();
> > -	while (owner_running(sem, owner)) {
> > -		/* abort spinning when need_resched */
> > -		if (need_resched()) {
> > +	while (sem->owner == owner) {
> > +		/*
> > +		 * Ensure we emit the owner->on_cpu, dereference _after_
> > +		 * checking sem->owner still matches owner, if that fails,
> > +		 * owner might point to free()d memory, if it still matches,
> > +		 * the rcu_read_lock() ensures the memory stays valid.
>                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> Yes, this is another case when we wrongly assume this.
> 
> Peter, should I resend
> 
> 	[PATCH 3/3] introduce task_rcu_dereference()
> 	http://marc.info/?l=linux-kernel&m=141443631413914
> 
> ? or should we add another call_rcu() in finish_task_switch() (like -rt does)
> to make this true?

Yeah, I think the extra call_rcu() makes most sense.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/