linux-kernel - [PATCH] workqueue: Fix an object aliasing bug with `work_data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.1605170915070.6794@tp.orcam.me.uk>
Date:	Tue, 17 May 2016 12:04:33 +0100
From:	"Maciej W. Rozycki" <macro@...tec.com>
To:	Tejun Heo <tj@...nel.org>, Lai Jiangshan <jiangshanlai@...il.com>
CC:	<linux-kernel@...r.kernel.org>
Subject: [PATCH] workqueue: Fix an object aliasing bug with
 `work_data_bits'

Fix an aliasing issue causing a MIPS port build error:

In file included from include/linux/srcu.h:34:0,
                 from include/linux/notifier.h:15,
                 from ./arch/mips/include/asm/uprobes.h:9,
                 from include/linux/uprobes.h:61,
                 from include/linux/mm_types.h:13,
                 from ./arch/mips/include/asm/vdso.h:14,
                 from arch/mips/vdso/vdso.h:27,
                 from arch/mips/vdso/gettimeofday.c:11:
include/linux/workqueue.h: In function 'work_static':
include/linux/workqueue.h:186:2: error: dereferencing type-punned pointer will break strict-aliasing rules [-Werror=strict-aliasing]
  return *work_data_bits(work) & WORK_STRUCT_STATIC;
  ^
cc1: all warnings being treated as errors
make[2]: *** [arch/mips/vdso/gettimeofday.o] Error 1

with a CONFIG_DEBUG_OBJECTS_WORK configuration and GCC 5.2.0.  Use a
union to switch between pointers as per ISO C language rules.

Signed-off-by: Maciej W. Rozycki <macro@...tec.com>
Cc: stable@...r.kernel.org # v2.6.20+
---
 This has been probably missed with ports which do not use `-Werror' and 
consequently let warnings scroll by unnoticed.  Yet undefined behaviour 
results as the compiler is free to optimise (e.g. remove) code under the 
assumption that the two objects do not alias.

 Please apply then.  This reaches back to 2.6.20 I believe.

  Maciej

linux-work-data-bits.diff
Index: linux-sfr-shell/include/linux/workqueue.h
===================================================================
--- linux-sfr-shell.orig/include/linux/workqueue.h	2016-04-22 17:31:08.000000000 +0100
+++ linux-sfr-shell/include/linux/workqueue.h	2016-05-17 05:26:18.772193000 +0100
@@ -23,7 +23,16 @@ void delayed_work_timer_fn(unsigned long
  * The first word is the work queue pointer and the flags rolled into
  * one
  */
-#define work_data_bits(work) ((unsigned long *)(&(work)->data))
+#define work_data_bits(work)						\
+({									\
+	union {								\
+		atomic_long_t *a;					\
+		unsigned long *l;					\
+	} u;								\
+									\
+	u.a = &(work)->data;						\
+	u.l;								\
+})
 
 enum {
 	WORK_STRUCT_PENDING_BIT	= 0,	/* work item is pending execution */