linux-kernel - Re: [PATCH] timers: Fix up get_target

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190604054216.GB15459@xz-x1>
Date:   Tue, 4 Jun 2019 13:42:16 +0800
From:   Peter Xu <peterx@...hat.com>
To:     linux-kernel@...r.kernel.org
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        John Stultz <john.stultz@...aro.org>,
        Stephen Boyd <sboyd@...nel.org>,
        Luiz Capitulino <lcapitulino@...hat.com>,
        Marcelo Tosatti <mtosatti@...hat.com>
Subject: Re: [PATCH] timers: Fix up get_target_base() to use old base properly

On Mon, Jun 03, 2019 at 09:29:44PM +0800, Peter Xu wrote:
> get_target_base() in the timer code is not using the "base" parameter
> at all.  My gut feeling is that instead of removing that extra
> parameter, what we really want to do is "return the old base if it
> does not suite for a new one".

I'm trying to think of a detailed scenario of this patch:

  1. setup a timer T1 with TIMER_PINNED on cpu 3 and arm it

  2. on another cpu (e.g., cpu 4), call mod_timer() upon T1 before the
     timer fires itself

     2.1. in __mod_timer(), lock_timer_base() will return cpu 3's
          timer base because it was pinned with cpu 3

     2.2. in the same __mod_timer(), get_target_base() will return cpu
          4's timer base if without this patch, and will return cpu
          3's timer base if with this patch

I don't know whether step 2 is easy to happen but I don't see why it
was forbidden so I'm assuming it could still happen... Then IMHO if
without this patch, the timer T1 will be queued on cpu 4's timer base
rather than cpu 3's, which seems to break TIMER_PINNED.

And just in case if this patch makes sense - get_timer_this_cpu_base()
can be dropped together since not used any more.

-- 
Peter Xu