linux-kernel - Re: [PATCH locking/Documentation 1/2] Add note of release-acquire store vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 30 Sep 2016 10:20:09 +0100
From:   Will Deacon <will.deacon@....com>
To:     Boqun Feng <boqun.feng@...il.com>
Cc:     "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
        Peter Zijlstra <peterz@...radead.org>,
        linux-kernel@...r.kernel.org, mingo@...nel.org,
        dhowells@...hat.com, stern@...land.harvard.edu
Subject: Re: [PATCH locking/Documentation 1/2] Add note of release-acquire
 store vulnerability

On Fri, Sep 30, 2016 at 01:53:52PM +0800, Boqun Feng wrote:
> On Thu, Sep 29, 2016 at 10:23:22AM -0700, Paul E. McKenney wrote:
> > If two processes are related by a RELEASE+ACQUIRE pair, ordering can be
> > broken if a third process overwrites the value written by the RELEASE
> > operation before the ACQUIRE operation has a chance of reading it, for
> > example:
> > 
> > 	P0(int *x, int *y)
> > 	{
> > 		WRITE_ONCE(*x, 1);
> > 		smp_wmb();
>                ^^^^^^^^^^^
> 
> What is this smp_wmb() for?
> 
> > 		smp_store_release(y, 1);
> > 	}
> > 
> > 	P1(int *y)
> > 	{
> > 		WRITE_ONCE(*y, 2);
> 
> If we change this WRITE_ONCE to a relaxed atomic operation(e.g.
> xchg_relaxed(y, 2)), both herd and ppcmem said the exist-clause "y = 2
> /\ 2:r1 = 2 /\ 2:r2 = 0" wouldn't be triggered on PPC.
> 
> I guess we will get the same behavior on ARM/ARM64, Will?
> 
> If a normal store could break chain, while a RmW atomic won't, do we
> want to call it out in the document and build our memory model around
> this?

I think this is required to work by C11's definition of release sequences,
so any architecture that claims to support those with the same instructions
will need this to be forbidden.

Personally, I think that's a bug in C11, because I think it goes too far
in forbidding some hardware optimisations around relaxed xchg, but it is
what it is.

Will