linux-kernel - Re: [PATCH] kthread: Fix race condition between kthread_parkme() and kthread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 Jul 2017 17:13:27 -0700
From:   Junaid Shahid <junaids@...gle.com>
To:     Andrew Morton <akpm@...ux-foundation.org>,
        Thomas Gleixner <tglx@...utronix.de>, Tejun Heo <tj@...nel.org>
Cc:     linux-kernel@...r.kernel.org, andreslc@...gle.com,
        gthelen@...gle.com, rusty@...tcorp.com.au
Subject: Re: [PATCH] kthread: Fix race condition between kthread_parkme() and kthread_unpark()

Hi,

Has anyone been able to take a look at this?

Thanks,
Junaid

On Tuesday, May 30, 2017 03:40:02 PM Andrew Morton wrote:
> (cc tglx & tj)
> 
> On Tue, 30 May 2017 15:37:23 -0700 Junaid Shahid <junaids@...gle.com> wrote:
> 
> > (Resending)
> > 
> > On Friday, April 28, 2017 07:32:36 PM Junaid Shahid wrote:
> > > In general, if kthread_unpark() and kthread_parkme() execute together,
> > > the kthread is supposed to be in an unparked state. This is because
> > > kthread_unpark() either wakes up the thread if it already got parked,
> > > or it cancels a prior kthread_park() call and hence renders the
> > > kthread_parkme() moot.
> > > 
> > > However, if kthread_unpark() happens to execute between the time that
> > > kthread_parkme() checks the KTHREAD_SHOULD_STOP flag and sets the
> > > KTHREAD_IS_PARKED flag, then kthread_unpark() will not wake up the
> > > thread and it will remain in a parked state.
> > > 
> > > This is fixed by making the checking of KTHREAD_SHOULD_STOP and the
> > > setting of KTHREAD_IS_PARKED atomic via a cmpxchg inside kthread_parkme.
> > > 
> > > Signed-off-by: Junaid Shahid <junaids@...gle.com>
> > > ---
> > >  kernel/kthread.c | 16 ++++++++++++----
> > >  1 file changed, 12 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/kernel/kthread.c b/kernel/kthread.c
> > > index 26db528c1d88..651f03baf62f 100644
> > > --- a/kernel/kthread.c
> > > +++ b/kernel/kthread.c
> > > @@ -169,12 +169,20 @@ void *kthread_probe_data(struct task_struct *task)
> > >  
> > >  static void __kthread_parkme(struct kthread *self)
> > >  {
> > > +	ulong flags;
> > > +
> > >  	__set_current_state(TASK_PARKED);
> > > -	while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
> > > -		if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
> > > -			complete(&self->parked);
> > > -		schedule();
> > > +	flags = self->flags;
> > > +
> > > +	while (test_bit(KTHREAD_SHOULD_PARK, &flags)) {
> > > +		if (cmpxchg(&self->flags, flags,
> > > +			    flags | (1 << KTHREAD_IS_PARKED)) == flags) {
> > > +			if (!test_bit(KTHREAD_IS_PARKED, &flags))
> > > +				complete(&self->parked);
> > > +			schedule();
> > > +		}
> > >  		__set_current_state(TASK_PARKED);
> > > +		flags = self->flags;
> > >  	}
> > >  	clear_bit(KTHREAD_IS_PARKED, &self->flags);
> > >  	__set_current_state(TASK_RUNNING);
> > >