linux-kernel - Re: [PATCH v3] time: Fix incorrect sleeptime injection when suspend fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALAqxLXdLnDJMBsazpYdSshqYArrwFQ9=_t9g8veFtBXQYRY_Q@mail.gmail.com>
Date:   Mon, 16 Jul 2018 11:54:13 -0700
From:   John Stultz <john.stultz@...aro.org>
To:     Mukesh Ojha <mojha@...eaurora.org>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        lkml <linux-kernel@...r.kernel.org>, gkohli@...eaurora.org,
        cpandya@...eaurora.org, neeraju@...eaurora.org,
        Baolin Wang <baolin.wang@...aro.org>
Subject: Re: [PATCH v3] time: Fix incorrect sleeptime injection when suspend fails

On Mon, Jul 16, 2018 at 11:30 AM, Mukesh Ojha <mojha@...eaurora.org> wrote:
>
>
> On 7/16/2018 10:44 PM, John Stultz wrote:
>>
>> On Mon, Jul 16, 2018 at 9:30 AM, John Stultz <john.stultz@...aro.org>
>> wrote:
>>>
>>> On Mon, Jul 16, 2018 at 9:17 AM, Mukesh Ojha <mojha@...eaurora.org>
>>> wrote:
>>>>
>>>> On 7/13/2018 10:50 PM, John Stultz wrote:
>>>>>
>>>>> On Fri, Jul 13, 2018 at 12:13 AM, Mukesh Ojha <mojha@...eaurora.org>
>>>>>>
>>>>>> On 7/11/2018 1:43 AM, John Stultz wrote:
>>>>>>>
>>>>>>> I worry this upside-down logic is too subtle to be easily reasoned
>>>>>>> about, and will just lead to future mistakes.
>>>>>>>
>>>>>>> Can we instead call this "suspend_timing_needed" and only set it to
>>>>>>> true when we don't inject any sleep time on resume?
>>>>>>
>>>>>>
>>>>>> I did not get your point "only set it to true when we don't inject any
>>>>>> sleep
>>>>>> time on resume? "
>>>>>> How do we know  this ?
>>>>>> This question itself depends on the "sleeptime_injected" if it is true
>>>>>> means
>>>>>> no need to inject else need to inject.
>>>>>>
>>>>>> Also, we need to make this variable back and forth true, false;
>>>>>> suspends
>>>>>> path ensures it to make it false.
>>>>>
>>>>> So yea, I'm not saying logically the code is really any different,
>>>>> this is more of a naming nit. So instead of having a variable that is
>>>>> always on that we occasionally turn off, lets invert the naming and
>>>>> have it be a flag that we occasionally turn on.
>>>>
>>>>
>>>> I understand your concern about the name of the variable will be
>>>> misleading.
>>>> But the changing Boolean state would not solve the actual issue.
>>>>
>>>> If i understand you correctly you meant below code
>>>>
>>>> diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
>>>> index 32ae9ae..becc5bd 100644
>>>> --- a/kernel/time/timekeeping.c
>>>> +++ b/kernel/time/timekeeping.c
>>>> @@ -1523,7 +1523,7 @@ void __weak read_boot_clock64(struct timespec64
>>>> *ts)
>>>>    * If a suspend fails before reaching timekeeping_resume() then the
>>>> flag
>>>>    * stays true and prevents erroneous sleeptime injection.
>>>>    */
>>>> -static bool sleeptime_injected = true;
>>>> +static bool suspend_timing_needed;
>>>>
>>>>   /* Flag for if there is a persistent clock on this platform */
>>>>   static bool persistent_clock_exists;
>>>> @@ -1658,7 +1658,7 @@ void timekeeping_inject_sleeptime64(struct
>>>> timespec64
>>>> *delta)
>>>>          raw_spin_lock_irqsave(&timekeeper_lock, flags);
>>>>          write_seqcount_begin(&tk_core.seq);
>>>>
>>>> -       sleeptime_injected = true;
>>>> +       suspend_timing_needed = false;
>>>>
>>>>          timekeeping_forward_now(tk);
>>>>
>>>> @@ -1714,10 +1714,10 @@ void timekeeping_resume(void)
>>>>                                                tk->tkr_mono.mask);
>>>>                  nsec = mul_u64_u32_shr(cyc_delta, clock->mult,
>>>> clock->shift);
>>>>                  ts_delta = ns_to_timespec64(nsec);
>>>> -               sleeptime_injected = true;
>>>> +               suspend_timing_needed = true;
>>>>          } else if (timespec64_compare(&ts_new,
>>>> &timekeeping_suspend_time) >
>>>> 0) {
>>>>                  ts_delta = timespec64_sub(ts_new,
>>>> timekeeping_suspend_time);
>>>> -               sleeptime_injected = true;
>>>> +               suspend_timing_needed = true;
>>>>          }
>>>
>>> No no... This part is wrong. We only set suspend_timing_needed if we
>>> *didn't* calculate the suspend time in timekeeping_resume.
>>>
>>> You have to invert all the boolean logic for it to be equivalent.
>>>
>> ...
>>>>
>>>>    <sleeptime injection happens here>
>>>
>>>
>>> So, I think with the logic bug above it will work out properly, but
>>> let me know if I'm still missing something.
>
>
> Please give it thought to a case where very first suspend fails with your
> logic.

I believe I did. If the first suspend fails, we never reach
timekeeping_resume, so we never set "suspend_time_needed = true", so
then timekeeping_rtc_skipresume can then return true, and we don't
inject the time in the RTC code.

> If i am not able to get your thought, please write a patch.

I probably will, but I'd like to encourage you to follow through on
this one. You reported the issue, and submitted a few patches, so I
think it would be good for you to also get the patch credit here. I
don't believe its a complex request I've made, and I think you can
figure it out.

So, please, take one more real stab at this and I'll rework it if it
seems necessary.

thanks
-john