linux-kernel - [PATCH] locking/mutex: Set and clear owner using WRITE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1463696630.2587.95.camel@j-VirtualBox>
Date:	Thu, 19 May 2016 15:23:50 -0700
From:	Jason Low <jason.low2@....com>
To:	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>
Cc:	linux-kernel@...r.kernel.org, Waiman Long <waiman.long@....com>,
	Davidlohr Bueso <dave@...olabs.net>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	Terry Rudd <terry.rudd@....com>,
	Scott J Norton <scott.norton@....com>,
	Jason Low <jason.low2@...com>
Subject: [PATCH] locking/mutex: Set and clear owner using WRITE_ONCE()

The mutex owner can get read and written to without the wait_lock.
Use WRITE_ONCE when setting and clearing the owner field in order
to avoid optimizations such as store tearing. This avoids
situations where the owner field gets written to with multiple
stores and another thread could concurrently read and use a
partially written owner value.

Signed-off-by: Jason Low <jason.low2@....com>
---
 kernel/locking/mutex.h | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/kernel/locking/mutex.h b/kernel/locking/mutex.h
index 5cda397..469b61e 100644
--- a/kernel/locking/mutex.h
+++ b/kernel/locking/mutex.h
@@ -17,14 +17,20 @@
 		__list_del((waiter)->list.prev, (waiter)->list.next)
 
 #ifdef CONFIG_MUTEX_SPIN_ON_OWNER
+/*
+ * The mutex owner can get read and written to locklessly.
+ * We should use WRITE_ONCE() when writing the owner value to
+ * avoid store tearing, otherwise, a thread could potentially
+ * read a partially written and incomplete owner value.
+ */
 static inline void mutex_set_owner(struct mutex *lock)
 {
-	lock->owner = current;
+	WRITE_ONCE(lock->owner, current);
 }
 
 static inline void mutex_clear_owner(struct mutex *lock)
 {
-	lock->owner = NULL;
+	WRITE_ONCE(lock->owner, NULL);
 }
 #else
 static inline void mutex_set_owner(struct mutex *lock)
-- 
2.1.4