linux-kernel - Re: [PATCH] irq_work: Fix IRQ_WORK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Nov 2019 15:56:25 +0000
From:   Leonard Crestez <leonard.crestez@....com>
To:     Frederic Weisbecker <frederic@...nel.org>,
        Ingo Molnar <mingo@...nel.org>
CC:     LKML <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        "Paul E . McKenney" <paulmck@...ux.vnet.ibm.com>,
        kernel test robot <rong.a.chen@...el.com>,
        Viresh Kumar <viresh.kumar@...aro.org>
Subject: Re: [PATCH] irq_work: Fix IRQ_WORK_BUZY bit clearing

On 13.11.2019 19:12, Frederic Weisbecker wrote:
> While attempting to clear the buzy bit at the end of a work execution,
> atomic_cmpxchg() expects the value of the flags with the pending bit
> cleared as the old value. However we are passing by mistake the value of
> the flags before we actually cleared the pending bit.

Busy is spelled with an S

> 
> As a result, clearing the buzy bit fails and irq_work_sync() may stall:
> 
> 	watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [blktrace:4948]
> 	CPU: 0 PID: 4948 Comm: blktrace Not tainted 5.4.0-rc7-00003-gfeb4a51323bab #1
> 	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> 	RIP: 0010:irq_work_sync+0x4/0x10
> 	Call Trace:
> 	  relay_close_buf+0x19/0x50
> 	  relay_close+0x64/0x100
> 	  blk_trace_free+0x1f/0x50
> 	  __blk_trace_remove+0x1e/0x30
> 	  blk_trace_ioctl+0x11b/0x140
> 	  blkdev_ioctl+0x6c1/0xa40
> 	  block_ioctl+0x39/0x40
> 	  do_vfs_ioctl+0xa5/0x700
> 	  ksys_ioctl+0x70/0x80
> 	  __x64_sys_ioctl+0x16/0x20
> 	  do_syscall_64+0x5b/0x1d0
> 	  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> So clear the appropriate bit before passing the old flags to cmpxchg().
> 
> Reported-by: kernel test robot <rong.a.chen@...el.com>
> Reported-by: Leonard Crestez <leonard.crestez@....com>
> Fixes: feb4a51323ba ("irq_work: Slightly simplify IRQ_WORK_PENDING clearing")
> Signed-off-by: Frederic Weisbecker <frederic@...nel.org>
> Cc: Paul E . McKenney <paulmck@...ux.vnet.ibm.com>
> Cc: Peter Zijlstra <peterz@...radead.org> everywhere.
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Ingo Molnar <mingo@...nel.org>

Tested-by: Leonard Crestez <leonard.crestez@....com>

Without this patch switching cpufreq governors hangs on arm64.

> ---
>   kernel/irq_work.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/irq_work.c b/kernel/irq_work.c
> index 49c53f80a13a..828cc30774bc 100644
> --- a/kernel/irq_work.c
> +++ b/kernel/irq_work.c
> @@ -158,6 +158,7 @@ static void irq_work_run_list(struct llist_head *list)
>   		 * Clear the BUSY bit and return to the free state if
>   		 * no-one else claimed it meanwhile.
>   		 */
> +		flags &= ~IRQ_WORK_PENDING;
>   		(void)atomic_cmpxchg(&work->flags, flags, flags & ~IRQ_WORK_BUSY);
>   	}
>   }
>