linux-kernel - [PATCH 4.4 31/87] futex: Replace barrier() in unqueue_me() with READ

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180115123352.472950416@linuxfoundation.org>
Date:   Mon, 15 Jan 2018 13:34:30 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Jianyu Zhan <nasa4836@...il.com>,
        Christian Borntraeger <borntraeger@...ibm.com>,
        Darren Hart <dvhart@...ux.intel.com>, dave@...olabs.net,
        peterz@...radead.org, linux@...musvillemoes.dk,
        akpm@...ux-foundation.org, fengguang.wu@...el.com,
        bigeasy@...utronix.de, Thomas Gleixner <tglx@...utronix.de>,
        Davidlohr Bueso <dbueso@...e.de>
Subject: [PATCH 4.4 31/87] futex: Replace barrier() in unqueue_me() with READ_ONCE()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jianyu Zhan <nasa4836@...il.com>

commit 29b75eb2d56a714190a93d7be4525e617591077a upstream.

Commit e91467ecd1ef ("bug in futex unqueue_me") introduced a barrier() in
unqueue_me() to prevent the compiler from rereading the lock pointer which
might change after a check for NULL.

Replace the barrier() with a READ_ONCE() for the following reasons:

1) READ_ONCE() is a weaker form of barrier() that affects only the specific
   load operation, while barrier() is a general compiler level memory barrier.
   READ_ONCE() was not available at the time when the barrier was added.

2) Aside of that READ_ONCE() is descriptive and self explainatory while a
   barrier without comment is not clear to the casual reader.

No functional change.

[ tglx: Massaged changelog ]

Signed-off-by: Jianyu Zhan <nasa4836@...il.com>
Acked-by: Christian Borntraeger <borntraeger@...ibm.com>
Acked-by: Darren Hart <dvhart@...ux.intel.com>
Cc: dave@...olabs.net
Cc: peterz@...radead.org
Cc: linux@...musvillemoes.dk
Cc: akpm@...ux-foundation.org
Cc: fengguang.wu@...el.com
Cc: bigeasy@...utronix.de
Link: http://lkml.kernel.org/r/1457314344-5685-1-git-send-email-nasa4836@gmail.com
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Signed-off-by: Davidlohr Bueso <dbueso@...e.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 kernel/futex.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1939,8 +1939,12 @@ static int unqueue_me(struct futex_q *q)
 
 	/* In the common case we don't take the spinlock, which is nice. */
 retry:
-	lock_ptr = q->lock_ptr;
-	barrier();
+	/*
+	 * q->lock_ptr can change between this read and the following spin_lock.
+	 * Use READ_ONCE to forbid the compiler from reloading q->lock_ptr and
+	 * optimizing lock_ptr out of the logic below.
+	 */
+	lock_ptr = READ_ONCE(q->lock_ptr);
 	if (lock_ptr != NULL) {
 		spin_lock(lock_ptr);
 		/*