linux-kernel - Re: [PATCH 2/5] ipc/mqueue.c: Update/document memory barriers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5e08cb89-563c-4763-dd88-94edaf9d883b@colorfullife.com>
Date:   Fri, 11 Oct 2019 20:53:25 +0200
From:   Manfred Spraul <manfred@...orfullife.com>
To:     Davidlohr Bueso <dave@...olabs.net>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Waiman Long <longman@...hat.com>, 1vier1@....de,
        Andrew Morton <akpm@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Jonathan Corbet <corbet@....net>
Subject: Re: [PATCH 2/5] ipc/mqueue.c: Update/document memory barriers

On 10/11/19 6:55 PM, Davidlohr Bueso wrote:
> On Fri, 11 Oct 2019, Manfred Spraul wrote:
>
>> Update and document memory barriers for mqueue.c:
>> - ewp->state is read without any locks, thus READ_ONCE is required.
>
> In general we relied on the barrier for not needing READ/WRITE_ONCE,
> but I agree this scenario should be better documented with them.

After reading core-api/atomic_ops.rst:

 > _ONCE() should be used. [...] Alternatively, you can place a barrier.

So both approaches are ok.

Let's follow the "should", i.e.: all operations on the ->state variables 
to READ_ONCE()/WRITE_ONCE().

Then we have a standard, and since we can follow the "should", we should 
do that.

> Similarly imo, the 'state' should also need them for write, even if
> under the lock -- consistency and documentation, for example.
>
Ok, so let's convert everything to _ONCE. (assuming that my analysis 
below is incorrect)
> In addition, I think it makes sense to encapsulate some of the
> pipelined send/recv operations, that also can allow us to keep
> the barrier comments in pipelined_send(), which I wonder why
> you chose to remove. Something like so, before your changes:
>
I thought that the simple "memory barrier is provided" is enough, so I 
had removed the comment.


But you are right, there are two different scenarios:

1) thread already in another wake_q, wakeup happens immediately after 
the cmpxchg_relaxed().

This scenario is safe, due to the smp_mb__before_atomic() in wake_q_add()

2) thread woken up but e.g. a timeout, see ->state=STATE_READY, returns 
to user space, calls sys_exit.

This must not happen before get_task_struct acquired a reference.

And this appears to be unsafe: get_task_struct() is refcount_inc(), 
which is refcount_inc_checked(), which is according to lib/refcount.c 
fully unordered.

Thus: ->state=STATE_READY can execute before the refcount increase.

Thus: ->state=STATE_READY needs a smp_store_release(), correct?

> diff --git a/ipc/mqueue.c b/ipc/mqueue.c
> index 3d920ff15c80..be48c0ba92f7 100644
> --- a/ipc/mqueue.c
> +++ b/ipc/mqueue.c
> @@ -918,17 +918,12 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, 
> u_name)
>  * The same algorithm is used for senders.
>  */
>
> -/* pipelined_send() - send a message directly to the task waiting in
> - * sys_mq_timedreceive() (without inserting message into a queue).
> - */
> -static inline void pipelined_send(struct wake_q_head *wake_q,
> +static inline void __pipelined_op(struct wake_q_head *wake_q,
>                   struct mqueue_inode_info *info,
> -                  struct msg_msg *message,
> -                  struct ext_wait_queue *receiver)
> +                  struct ext_wait_queue *this)
> {
> -    receiver->msg = message;
> -    list_del(&receiver->list);
> -    wake_q_add(wake_q, receiver->task);
> +    list_del(&this->list);
> +    wake_q_add(wake_q, this->task);
>     /*
>      * Rely on the implicit cmpxchg barrier from wake_q_add such
>      * that we can ensure that updating receiver->state is the last
> @@ -937,7 +932,19 @@ static inline void pipelined_send(struct 
> wake_q_head *wake_q,
>      * yet, at that point we can later have a use-after-free
>      * condition and bogus wakeup.
>      */
> -    receiver->state = STATE_READY;
> +        this->state = STATE_READY;
> +}
> +
> +/* pipelined_send() - send a message directly to the task waiting in
> + * sys_mq_timedreceive() (without inserting message into a queue).
> + */
> +static inline void pipelined_send(struct wake_q_head *wake_q,
> +                  struct mqueue_inode_info *info,
> +                  struct msg_msg *message,
> +                  struct ext_wait_queue *receiver)
> +{
> +    receiver->msg = message;
> +    __pipelined_op(wake_q, info, receiver);
> }
>
> /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
> @@ -955,9 +962,7 @@ static inline void pipelined_receive(struct 
> wake_q_head *wake_q,
>     if (msg_insert(sender->msg, info))
>         return;
>
> -    list_del(&sender->list);
> -    wake_q_add(wake_q, sender->task);
> -    sender->state = STATE_READY;
> +    __pipelined_op(wake_q, info, sender);
> }
>
> static int do_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,

I would merge that into the series, ok?

--

     Manfred