linux-kernel - Re: [PATCH] ipc/sem.c: Fix complex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20160721131632.51fa6a14f6f81ce1e3ef08d8@linux-foundation.org>
Date:	Thu, 21 Jul 2016 13:16:32 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Manfred Spraul <manfred@...orfullife.com>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Davidlohr Bueso <dave@...olabs.net>,
	LKML <linux-kernel@...r.kernel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...e.hu>, 1vier1@....de,
	felixh@...ormatik.uni-bremen.de, <stable@...r.kernel.org>
Subject: Re: [PATCH] ipc/sem.c: Fix complex_count vs. simple op race

On Thu, 21 Jul 2016 19:54:55 +0200 Manfred Spraul <manfred@...orfullife.com> wrote:

> Next update:
> - switch to smp_store_mb() instead of WRITE_ONCE();smp_mb();
> - introduce SEM_GLOBAL_LOCK instead of magic -1.
> - do not use READ_ONCE() for the unlocked&unordered test:
>   READ_ONCE doesn't make sense for unlocked&unordered code.
> - document why smp_mb() is required after spin_lock().

I assume "ipc/sem.c: remove duplicated memory barriers" is still
relevant?


From: Manfred Spraul <manfred@...orfullife.com>
Subject: ipc/sem.c: remove duplicated memory barriers

With 2c610022711 ("locking/qspinlock: Fix spin_unlock_wait() some more"),
memory barriers were added into spin_unlock_wait().  Thus another barrier
is not required.

And as explained in 055ce0fd1b8 ("locking/qspinlock: Add comments"),
spin_lock() provides a barrier so that reads within the critical section
cannot happen before the write for the lock is visible.  i.e.  spin_lock
provides an acquire barrier after the write of the lock variable, this
barrier pairs with the smp_mb() in complexmode_enter().

Link: http://lkml.kernel.org/r/1468386412-3608-3-git-send-email-manfred@colorfullife.com
Signed-off-by: Manfred Spraul <manfred@...orfullife.com>
Cc: "H. Peter Anvin" <hpa@...or.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Davidlohr Bueso <dave@...olabs.net>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Ingo Molnar <mingo@...e.hu>
Cc: <1vier1@....de>
Cc: <felixh@...ormatik.uni-bremen.de>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 ipc/sem.c |   16 ----------------
 1 file changed, 16 deletions(-)

diff -puN ipc/sem.c~ipc-semc-remove-duplicated-memory-barriers ipc/sem.c
--- a/ipc/sem.c~ipc-semc-remove-duplicated-memory-barriers
+++ a/ipc/sem.c
@@ -290,14 +290,6 @@ static void complexmode_enter(struct sem
 		sem = sma->sem_base + i;
 		spin_unlock_wait(&sem->lock);
 	}
-	/*
-	 * spin_unlock_wait() is not a memory barriers, it is only a
-	 * control barrier. The code must pair with spin_unlock(&sem->lock),
-	 * thus just the control barrier is insufficient.
-	 *
-	 * smp_rmb() is sufficient, as writes cannot pass the control barrier.
-	 */
-	smp_rmb();
 }
 
 /*
@@ -363,14 +355,6 @@ static inline int sem_lock(struct sem_ar
 		 */
 		spin_lock(&sem->lock);
 
-		/*
-		 * See 51d7d5205d33
-		 * ("powerpc: Add smp_mb() to arch_spin_is_locked()"):
-		 * A full barrier is required: the write of sem->lock
-		 * must be visible before the read is executed
-		 */
-		smp_mb();
-
 		if (!smp_load_acquire(&sma->complex_mode)) {
 			/* fast path successful! */
 			return sops->sem_num;
_