linux-kernel - Re: [PATCH] perf/ring_buffer: ensure atomicity and order of updates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180523164234.GJ2983@arm.com>
Date:   Wed, 23 May 2018 17:42:34 +0100
From:   Will Deacon <will.deacon@....com>
To:     Mark Rutland <mark.rutland@....com>
Cc:     linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH] perf/ring_buffer: ensure atomicity and order of updates

On Thu, May 10, 2018 at 02:06:32PM +0100, Mark Rutland wrote:
> Userspace can read/write the user page at any point in time, and in
> perf_output_put_handle() we're very careful to use memory barriers to
> ensure ordering between updates to data and the user page.
> 
> We don't use barriers when updating aux_head, where similar ordering
> constraints apply. This could result in userspace seeing stale data, or
> data being overwritten while userspace was still consuming it.
> 
> Further, we update data_head and aux_head with plain assignments, which
> the compiler can tear, potentially resulting in userspace seeing
> erroneous values.
> 
> We can solve both of these problems by using smp_store_release to update
> data_head and aux_head, so let's do so.
> 
> Signed-off-by: Mark Rutland <mark.rutland@....com>
> Cc: Ingo Molnar <mingo@...hat.com>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Will Deacon <will.deacon@....com>
> ---
>  kernel/events/ring_buffer.c | 13 ++++++-------
>  1 file changed, 6 insertions(+), 7 deletions(-)
> 
> diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
> index 6c6b3c48db71..839b207e4c77 100644
> --- a/kernel/events/ring_buffer.c
> +++ b/kernel/events/ring_buffer.c
> @@ -63,10 +63,10 @@ static void perf_output_put_handle(struct perf_output_handle *handle)
>  	 *   kernel				user
>  	 *
>  	 *   if (LOAD ->data_tail) {		LOAD ->data_head
> -	 *			(A)		smp_rmb()	(C)
> +	 *				(A) 	smp_rmb()	(C)
>  	 *	STORE $data			LOAD $data
> -	 *	smp_wmb()	(B)		smp_mb()	(D)
> -	 *	STORE ->data_head		STORE ->data_tail
> +	 *					smp_mb()	(D)
> +	 *	RELEASE ->data_head	(B)	STORE ->data_tail
>  	 *   }

One thing to be aware of here is that the choice of ordering primitive (e.g.
using fences vs acquire/release operations) has the potential to create
ABI with userspace. I don't know of any architectures which currently care,
but if were were to merge a non multi-copy atomic architecture with native
acquire/release instructions, you could see issues if e.g. userspace used
smp_rmb(); READ_ONCE but the kernel used a RELEASE store.

Anyway, that's currently theoretical, but I think it's an argument for
putting these accessors in a uapi header.

Will