linux-kernel - [PATCH] poll: Ignore benign race on pwd->triggered

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 29 Apr 2021 13:44:11 +1000
From:   Baptiste Lepers <baptiste.lepers@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     trivial@...nel.org, Baptiste Lepers <baptiste.lepers@...il.com>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Miklos Szeredi <mszeredi@...e.cz>,
        Tejun Heo <htejun@...il.com>, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] poll: Ignore benign race on pwd->triggered

Mark data races to pwd->triggered as benign using READ_ONCE and
WRITE_ONCE. These accesses are expected to be racy per comment.

This patch is part of a series of patches aiming at reducing the number
of benign races reported by KCSAN in order to focus future debugging
effort on harmful races.

Reported-by: syzbot+9b3fb64bcc8c1d807595@...kaller.appspotmail.com
Fixes: 5f820f648c92a ("poll: allow f_op->poll to sleep")
Signed-off-by: Baptiste Lepers <baptiste.lepers@...il.com>
---
 fs/select.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/select.c b/fs/select.c
index 945896d0ac9e..e71b4d1a2606 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -194,7 +194,7 @@ static int __pollwake(wait_queue_entry_t *wait, unsigned mode, int sync, void *k
 	 * and is paired with smp_store_mb() in poll_schedule_timeout.
 	 */
 	smp_wmb();
-	pwq->triggered = 1;
+	WRITE_ONCE(pwq->triggered, 1);
 
 	/*
 	 * Perform the default wake up operation using a dummy
@@ -239,7 +239,7 @@ static int poll_schedule_timeout(struct poll_wqueues *pwq, int state,
 	int rc = -EINTR;
 
 	set_current_state(state);
-	if (!pwq->triggered)
+	if (!READ_ONCE(pwq->triggered))
 		rc = schedule_hrtimeout_range(expires, slack, HRTIMER_MODE_ABS);
 	__set_current_state(TASK_RUNNING);
 
-- 
2.17.1