linux-kernel - Re: [PATCH] futex: Drop now unnecessary check in exit_pi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20171106102312.GE3165@worktop.lehotels.local>
Date:   Mon, 6 Nov 2017 11:23:12 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Julia Cartwright <julia@...com>
Cc:     Ingo Molnar <mingo@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        linux-kernel@...r.kernel.org,
        Gratian Crisan <gratian.crisan@...com>,
        Darren Hart <dvhart@...radead.org>
Subject: Re: [PATCH] futex: Drop now unnecessary check in exit_pi_state()

On Fri, Nov 03, 2017 at 05:30:28PM -0500, Julia Cartwright wrote:
> This check was an attempt to protect against a race with put_pi_state()
> by ensuring that the pi_state_list was consistent across the
> unlock/lock of pi_lock.
> 
> However, as of commit 153fbd1226fb3 ("futex: Fix more put_pi_state() vs.
> exit_pi_state_list() races"), this check is no longer necessary because
> we now hold a reference to the pi_state object across the unlock/lock of
> pi_lock.  This reference guarantees that a put_pi_state() on another CPU
> won't rip the pi_state object from the list when we drop pi_lock.

> @@ -929,17 +928,6 @@ void exit_pi_state_list(struct task_struct *curr)
>  		spin_lock(&hb->lock);
>  		raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
>  		raw_spin_lock(&curr->pi_lock);
> -		/*
> -		 * We dropped the pi-lock, so re-check whether this
> -		 * task still owns the PI-state:
> -		 */
> -		if (head->next != next) {

Quite possibly you're right, but I would sleep a whole lot better if
that were to remain a WARN. You never know with this futex stuff :-)