linux-kernel - [PATCH] kthread: Fix race condition between kthread_parkme() and kthread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170429023236.60452-1-junaids@google.com>
Date:   Fri, 28 Apr 2017 19:32:36 -0700
From:   Junaid Shahid <junaids@...gle.com>
To:     linux-kernel@...r.kernel.org
Cc:     andreslc@...gle.com, gthelen@...gle.com, rusty@...tcorp.com.au
Subject: [PATCH] kthread: Fix race condition between kthread_parkme() and kthread_unpark()

In general, if kthread_unpark() and kthread_parkme() execute together,
the kthread is supposed to be in an unparked state. This is because
kthread_unpark() either wakes up the thread if it already got parked,
or it cancels a prior kthread_park() call and hence renders the
kthread_parkme() moot.

However, if kthread_unpark() happens to execute between the time that
kthread_parkme() checks the KTHREAD_SHOULD_STOP flag and sets the
KTHREAD_IS_PARKED flag, then kthread_unpark() will not wake up the
thread and it will remain in a parked state.

This is fixed by making the checking of KTHREAD_SHOULD_STOP and the
setting of KTHREAD_IS_PARKED atomic via a cmpxchg inside kthread_parkme.

Signed-off-by: Junaid Shahid <junaids@...gle.com>
---
 kernel/kthread.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/kernel/kthread.c b/kernel/kthread.c
index 26db528c1d88..651f03baf62f 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -169,12 +169,20 @@ void *kthread_probe_data(struct task_struct *task)

 static void __kthread_parkme(struct kthread *self)
 {
+	ulong flags;
+
 	__set_current_state(TASK_PARKED);
-	while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
-		if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
-			complete(&self->parked);
-		schedule();
+	flags = self->flags;
+
+	while (test_bit(KTHREAD_SHOULD_PARK, &flags)) {
+		if (cmpxchg(&self->flags, flags,
+			    flags | (1 << KTHREAD_IS_PARKED)) == flags) {
+			if (!test_bit(KTHREAD_IS_PARKED, &flags))
+				complete(&self->parked);
+			schedule();
+		}
 		__set_current_state(TASK_PARKED);
+		flags = self->flags;
 	}
 	clear_bit(KTHREAD_IS_PARKED, &self->flags);
 	__set_current_state(TASK_RUNNING);
-- 
2.13.0.rc0.306.g87b477812d-goog