linux-kernel - Re: [patch 08/12] futex: Sanitize exit state handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191107093822.GD4131@hirez.programming.kicks-ass.net>
Date:   Thu, 7 Nov 2019 10:38:22 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Darren Hart <darren@...art.com>,
        Yi Wang <wang.yi59@....com.cn>,
        Yang Tao <yang.tao172@....com.cn>,
        Oleg Nesterov <oleg@...hat.com>,
        Florian Weimer <fweimer@...hat.com>,
        Carlos O'Donell <carlos@...hat.com>,
        Alexander Viro <viro@...iv.linux.org.uk>
Subject: Re: [patch 08/12] futex: Sanitize exit state handling

On Wed, Nov 06, 2019 at 10:55:42PM +0100, Thomas Gleixner wrote:
> Instead of having a smp_mb() and an empty lock/unlock of task::pi_lock move
> the state setting into to the lock section.
> 
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> ---
>  kernel/futex.c |   17 ++++++++++-------
>  1 file changed, 10 insertions(+), 7 deletions(-)
> 
> --- a/kernel/futex.c
> +++ b/kernel/futex.c
> @@ -3703,16 +3703,19 @@ void futex_exit_done(struct task_struct
>  
>  void futex_exit_release(struct task_struct *tsk)
>  {
> -	tsk->futex_state = FUTEX_STATE_EXITING;
> -	/*
> -	 * Ensure that all new tsk->pi_lock acquisitions must observe
> -	 * FUTEX_STATE_EXITING. Serializes against attach_to_pi_owner().
> -	 */
> -	smp_mb();
>  	/*
> -	 * Ensure that we must observe the pi_state in exit_pi_state_list().
> +	 * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock.
> +	 *
> +	 * This ensures that all subsequent checks of tsk->futex_state in
> +	 * attach_to_pi_owner() must observe FUTEX_STATE_EXITING with
> +	 * tsk->pi_lock held.
> +	 *
> +	 * It guarantees also that a pi_state which was queued right before
> +	 * the state change under tsk->pi_lock by a concurrent waiter must
> +	 * be observed in exit_pi_state_list().
>  	 */
>  	raw_spin_lock_irq(&tsk->pi_lock);
> +	tsk->futex_state = FUTEX_STATE_EXITING;
>  	raw_spin_unlock_irq(&tsk->pi_lock);

Right, much saner.

So this used to be:

	exit_signals(tsk) /* sets PF_EXITING */
	smp_mb();
	raw_spin_unlock_wait(&tsk->pi_lock);

Which is in fact (possibly) faster than the new sane code, since
unlock_wait() only has to wait for any current lock holder to complete.

However due to terrible semantics and implementation issues we got rid
of *spin_unlock_wait() and well.. lets all forget this :-)