linux-kernel - [tip:timers/urgent] timer: Write timer->flags atomically

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 18 Aug 2015 06:36:42 -0700
From:	tip-bot for Eric Dumazet <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux@...elenboom.it, davem@...emloft.net, hpa@...or.com,
	tglx@...utronix.de, edumazet@...gle.com,
	linux-kernel@...r.kernel.org, mingo@...nel.org, jon@...s.org
Subject: [tip:timers/urgent] timer: Write timer->flags atomically

Commit-ID:  d0023a1448abdcc892b8bca631e74bb1888efd02
Gitweb:     http://git.kernel.org/tip/d0023a1448abdcc892b8bca631e74bb1888efd02
Author:     Eric Dumazet <edumazet@...gle.com>
AuthorDate: Mon, 17 Aug 2015 10:18:48 -0700
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Tue, 18 Aug 2015 15:31:16 +0200

timer: Write timer->flags atomically

lock_timer_base() cannot prevent the following :

CPU1 ( in __mod_timer()
timer->flags |= TIMER_MIGRATING;
spin_unlock(&base->lock);
base = new_base;
spin_lock(&base->lock);
// The next line clears TIMER_MIGRATING
timer->flags &= ~TIMER_BASEMASK;
                                  CPU2 (in lock_timer_base())
                                  see timer base is cpu0 base
                                  spin_lock_irqsave(&base->lock, *flags);
                                  if (timer->flags == tf)
                                       return base; // oops, wrong base
timer->flags |= base->cpu // too late

We must write timer->flags in one go, otherwise we can fool other cpus.

Fixes: bc7a34b8b9eb ("timer: Reduce timer migration overhead if disabled")
Signed-off-by: Eric Dumazet <edumazet@...gle.com>
Cc: Jon Christopherson <jon@...s.org>
Cc: David Miller <davem@...emloft.net>
Cc: xen-devel@...ts.xen.org
Cc: david.vrabel@...rix.com
Cc: Sander Eikelenboom <linux@...elenboom.it>
Link: http://lkml.kernel.org/r/1439831928.32680.11.camel@edumazet-glaptop2.roam.corp.google.com
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Thomas Gleixner <tglx@...utronix.de>
---
 kernel/time/timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 5e097fa..84190f0 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -807,8 +807,8 @@ __mod_timer(struct timer_list *timer, unsigned long expires,
 			spin_unlock(&base->lock);
 			base = new_base;
 			spin_lock(&base->lock);
-			timer->flags &= ~TIMER_BASEMASK;
-			timer->flags |= base->cpu;
+			WRITE_ONCE(timer->flags,
+				   (timer->flags & ~TIMER_BASEMASK) | base->cpu);
 		}
 	}
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/