linux-kernel - Re: [PATCH 06/10] timer: Report ignored local enqueue in nohz mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210325130757.GA938196@lothringen>
Date:   Thu, 25 Mar 2021 14:07:57 +0100
From:   Frederic Weisbecker <frederic@...nel.org>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>,
        "Rafael J . Wysocki" <rafael.j.wysocki@...el.com>,
        Ti Zhou <x2019cwm@...x.ca>, Yunfeng Ye <yeyunfeng@...wei.com>,
        "Paul E . McKenney" <paulmck@...nel.org>,
        Marcelo Tosatti <mtosatti@...hat.com>,
        Ingo Molnar <mingo@...nel.org>
Subject: Re: [PATCH 06/10] timer: Report ignored local enqueue in nohz mode

On Tue, Mar 16, 2021 at 04:27:56PM +0100, Peter Zijlstra wrote:
> On Thu, Mar 11, 2021 at 01:37:04PM +0100, Frederic Weisbecker wrote:
> > Enqueuing a local timer after the tick has been stopped will result in
> > the timer being ignored until the next random interrupt.
> > 
> > Perform sanity checks to report these situations.
> > 
> > Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
> > Signed-off-by: Frederic Weisbecker <frederic@...nel.org>
> > Cc: Peter Zijlstra <peterz@...radead.org>
> > Cc: Thomas Gleixner <tglx@...utronix.de>
> > Cc: Ingo Molnar <mingo@...nel.org>
> > Cc: Paul E. McKenney <paulmck@...nel.org>
> > ---
> >  kernel/sched/core.c | 20 +++++++++++++++++++-
> >  1 file changed, 19 insertions(+), 1 deletion(-)
> > 
> > diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> > index ca2bb629595f..24552911f92b 100644
> > --- a/kernel/sched/core.c
> > +++ b/kernel/sched/core.c
> > @@ -674,6 +674,22 @@ int get_nohz_timer_target(void)
> >  	return cpu;
> >  }
> >  
> > +/* Make sure the timer won't be ignored in dynticks-idle case */
> > +static void wake_idle_assert_possible(void)
> > +{
> > +#ifdef CONFIG_SCHED_DEBUG
> > +	/*
> > +	 * Timers are re-evaluated after idle IRQs. In case of softirq,
> > +	 * we assume IRQ tail. Ksoftirqd shouldn't reach here as the
> > +	 * timer base wouldn't be idle. And inline softirq processing
> > +	 * after a call to local_bh_enable() within idle loop sound too
> > +	 * fun to be considered here.
> > +	 */
> > +	WARN_ONCE(in_task(),
> > +		  "Late timer enqueue may be ignored\n");
> > +#endif
> > +}
> > +
> >  /*
> >   * When add_timer_on() enqueues a timer into the timer wheel of an
> >   * idle CPU then this timer might expire before the next timer event
> > @@ -688,8 +704,10 @@ static void wake_up_idle_cpu(int cpu)
> >  {
> >  	struct rq *rq = cpu_rq(cpu);
> >  
> > -	if (cpu == smp_processor_id())
> > +	if (cpu == smp_processor_id()) {
> > +		wake_idle_assert_possible();
> >  		return;
> > +	}
> >  
> >  	if (set_nr_and_not_polling(rq->idle))
> >  		smp_send_reschedule(cpu);
> 
> I'm not entirely sure I understand this one. What's the callchain that
> leads to this?

That's while calling add_timer*() or mod_timer() on an idle target.

Now the issue is only relevant when these timer functions are called
after cpuidle_select(), which arguably makes a small vulnerable window
that could be spotted in the future if the timer functions are called
after instrumentation_end()?

Thanks.