linux-kernel - Re: [PATCH v2 08/11] drivers/base/test/test_async_driver_probe: convert to use counter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202010071119.0D23F28@keescook>
Date:   Wed, 7 Oct 2020 11:20:53 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Shuah Khan <skhan@...uxfoundation.org>
Cc:     gregkh@...uxfoundation.org, rafael@...nel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 08/11] drivers/base/test/test_async_driver_probe:
 convert to use counter_atomic32

On Tue, Oct 06, 2020 at 02:44:39PM -0600, Shuah Khan wrote:
> counter_atomic* is introduced to be used when a variable is used as
> a simple counter and doesn't guard object lifetimes. This clearly
> differentiates atomic_t usages that guard object lifetimes.
> 
> counter_atomic* variables will wrap around to 0 when it overflows and
> should not be used to guard resource lifetimes, device usage and
> open counts that control state changes, and pm states.
> 
> atomic_t variables used to count errors, warns, keep track of timeout,
> and async completion are counters.
> 
> Unsure overflow is a concern for timeout and async completion, and there
> are no checks for overflow to hold them to upper bounds. Overflow and
> wrap around doesn't impact errors, and warns.
> 
> Convert them to use counter_atomic32.
> 
> This conversion doesn't change the overflow wrap around behavior.
> 
> Reviewed-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Signed-off-by: Shuah Khan <skhan@...uxfoundation.org>
> ---
>  drivers/base/test/test_async_driver_probe.c | 23 ++++++++++++---------
>  1 file changed, 13 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/base/test/test_async_driver_probe.c b/drivers/base/test/test_async_driver_probe.c
> index 3bb7beb127a9..e969c1b09426 100644
> --- a/drivers/base/test/test_async_driver_probe.c
> +++ b/drivers/base/test/test_async_driver_probe.c
> @@ -14,11 +14,12 @@
>  #include <linux/numa.h>
>  #include <linux/nodemask.h>
>  #include <linux/topology.h>
> +#include <linux/counters.h>
>  
>  #define TEST_PROBE_DELAY	(5 * 1000)	/* 5 sec */
>  #define TEST_PROBE_THRESHOLD	(TEST_PROBE_DELAY / 2)
>  
> -static atomic_t warnings, errors, timeout, async_completed;
> +static struct counter_atomic32 warnings, errors, timeout, async_completed;

While it's currently harmless, this should likely be using
COUNTER_ATOMIC_INIT(0)s...

>  
>  static int test_probe(struct platform_device *pdev)
>  {
> @@ -29,9 +30,9 @@ static int test_probe(struct platform_device *pdev)
>  	 * have then report it as an error, otherwise we wil sleep for the
>  	 * required amount of time and then report completion.
>  	 */
> -	if (atomic_read(&timeout)) {
> +	if (counter_atomic32_read(&timeout)) {
>  		dev_err(dev, "async probe took too long\n");
> -		atomic_inc(&errors);
> +		counter_atomic32_inc(&errors);
>  	} else {
>  		dev_dbg(&pdev->dev, "sleeping for %d msecs in probe\n",
>  			 TEST_PROBE_DELAY);
> @@ -48,10 +49,10 @@ static int test_probe(struct platform_device *pdev)
>  		    dev_to_node(dev) != numa_node_id()) {
>  			dev_warn(dev, "NUMA node mismatch %d != %d\n",
>  				 dev_to_node(dev), numa_node_id());
> -			atomic_inc(&warnings);
> +			counter_atomic32_inc(&warnings);
>  		}
>  
> -		atomic_inc(&async_completed);
> +		counter_atomic32_inc(&async_completed);
>  	}
>  
>  	return 0;
> @@ -244,11 +245,12 @@ static int __init test_async_probe_init(void)
>  	 * Otherwise if they completed without errors or warnings then
>  	 * report successful completion.
>  	 */
> -	if (atomic_read(&async_completed) != async_id) {
> +	if (counter_atomic32_read(&async_completed) != async_id) {
>  		pr_err("async events still pending, forcing timeout\n");
> -		atomic_inc(&timeout);
> +		counter_atomic32_inc(&timeout);
>  		err = -ETIMEDOUT;
> -	} else if (!atomic_read(&errors) && !atomic_read(&warnings)) {
> +	} else if (!counter_atomic32_read(&errors) &&
> +		   !counter_atomic32_read(&warnings)) {
>  		pr_info("completed successfully\n");
>  		return 0;
>  	}
> @@ -271,12 +273,13 @@ static int __init test_async_probe_init(void)
>  	 * errors or warnings being reported by the probe routine.
>  	 */
>  	if (err)
> -		atomic_inc(&errors);
> +		counter_atomic32_inc(&errors);
>  	else
>  		err = -EINVAL;
>  
>  	pr_err("Test failed with %d errors and %d warnings\n",
> -	       atomic_read(&errors), atomic_read(&warnings));
> +	       counter_atomic32_read(&errors),
> +	       counter_atomic32_read(&warnings));
>  
>  	return err;
>  }
> -- 
> 2.25.1
> 

But yeah, this is otherwise just reporting and simple one-time synchronization.

Reviewed-by: Kees Cook <keescook@...omium.org>

-- 
Kees Cook