linux-kernel - During high load wait_event_timeout might return a wrong value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151110091812.1e7f326e@kalleka-typewriter>
Date:	Tue, 10 Nov 2015 09:18:12 +0200
From:	Kalle Kankare <kalle.kankare@...cit.fi>
To:	linux-kernel@...r.kernel.org
Cc:	Ingo Molnar <mingo@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>
Subject: During high load wait_event_timeout might return a wrong value

Hi,

The problem is that the call to might_sleep might sleep and the return value of wait_event_timeout does not account for the time slept in there.

The might_sleep includes a call to __schedule if CONFIG_PREEMPT_VOLUNTARY is defined.

A problematic scenario can be like the following:

- A driver calls wait_event_timeout with timeout = 10 jiffies, starts sleeping in might_sleep.
- An interrupt handler sets the condition true at 5 jiffies and calls wake_up for the waitqueue.
- Due to high load the might_sleep wakes up at 100 jiffies.
- In the next if the __wait_cond_timeout returns 1 without manipulating __ret.
- wait_event_timeout returns 10 where it should have returned 1 to denote that a timeout was reached.

Or am I misunderstanding what the return value should be ?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/