linux-kernel - Re: [PATCH 4.19 089/114] hrtimer: Annotate lockless access to timer->state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 3 Jan 2020 20:07:11 +0100
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        syzbot <syzkaller@...glegroups.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH 4.19 089/114] hrtimer: Annotate lockless access to
 timer->state

Hi!

> From: Eric Dumazet <edumazet@...gle.com>
> 
> commit 56144737e67329c9aaed15f942d46a6302e2e3d8 upstream.
> 
> syzbot reported various data-race caused by hrtimer_is_queued() reading
> timer->state. A READ_ONCE() is required there to silence the warning.
> 
> Also add the corresponding WRITE_ONCE() when timer->state is set.
> 
> In remove_hrtimer() the hrtimer_is_queued() helper is open coded to avoid
> loading timer->state twice.

Is there a reason why READ_ONCE is not neccessary in remove_hrtimer?

Should there be comment there explaining it?

Best regards,
								Pavel

> @@ -1002,8 +1004,9 @@ static void __remove_hrtimer(struct hrti
>  static inline int
>  remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
>  {
> -	if (hrtimer_is_queued(timer)) {
> -		u8 state = timer->state;
> +	u8 state = timer->state;
> +
> +	if (state & HRTIMER_STATE_ENQUEUED) {
>  		int reprogram;
>  
>  		/*
> 

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)