linux-kernel - Re: [PATCH] rwsem: fix missed wakeup due to reordering of load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 24 Aug 2017 13:29:27 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Prateek Sood <prsood@...eaurora.org>
Cc:     mingo@...hat.com, sramana@...eaurora.org,
        linux-kernel@...r.kernel.org, Waiman Long <longman@...hat.com>,
        Davidlohr Bueso <dave@...olabs.net>,
        Andrea Parri <parri.andrea@...il.com>
Subject: Re: [PATCH] rwsem: fix missed wakeup due to reordering of load


WTH did you not Cc the people that commented on your patch last time?

On Wed, Aug 23, 2017 at 04:58:55PM +0530, Prateek Sood wrote:
> If a spinner is present, there is a chance that the load of
> rwsem_has_spinner() in rwsem_wake() can be reordered with
> respect to decrement of rwsem count in __up_write() leading
> to wakeup being missed.

>  spinning writer                  up_write caller
>  ---------------                  -----------------------
>  [S] osq_unlock()                 [L] osq
>   spin_lock(wait_lock)
>   sem->count=0xFFFFFFFF00000001
>             +0xFFFFFFFF00000000
>   count=sem->count
>   MB
>                                    sem->count=0xFFFFFFFE00000001
>                                              -0xFFFFFFFF00000001
>                                    RMB

This doesn't make sense, it appears to order a STORE against something
else.

>                                    spin_trylock(wait_lock)
>                                    return
>  rwsem_try_write_lock(count)
>  spin_unlock(wait_lock)
>  schedule()