linux-kernel - Re: [PATCH] ipc/sem.c: use READ_ONCE()/WRITE_ONCE() for use_global

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210517031227.qqir3hk2z45pzjum@offworld>
Date:   Sun, 16 May 2021 20:12:27 -0700
From:   Davidlohr Bueso <dave@...olabs.net>
To:     Manfred Spraul <manfred@...orfullife.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Paul E . McKenney" <paulmck@...nel.org>, 1vier1@....de
Subject: Re: [PATCH] ipc/sem.c: use READ_ONCE()/WRITE_ONCE() for
 use_global_lock

On Fri, 14 May 2021, Manfred Spraul wrote:

>The patch solves two weaknesses in ipc/sem.c:
>
>1) The initial read of use_global_lock in sem_lock() is an
>intentional race. KCSAN detects these accesses and prints
>a warning.
>
>2) The code assumes that plain C read/writes are not
>mangled by the CPU or the compiler.
>
>To solve both issues, use READ_ONCE()/WRITE_ONCE().
>Plain C reads are used in code that owns sma->sem_perm.lock.
>

Reviewed-by: Davidlohr Bueso <dbueso@...e.de>

>Signed-off-by: Manfred Spraul <manfred@...orfullife.com>
>---
> ipc/sem.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
>diff --git a/ipc/sem.c b/ipc/sem.c
>index bf534c74293e..a0ad3a3edde2 100644
>--- a/ipc/sem.c
>+++ b/ipc/sem.c
>@@ -217,6 +217,8 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
>  * this smp_load_acquire(), this is guaranteed because the smp_load_acquire()
>  * is inside a spin_lock() and after a write from 0 to non-zero a
>  * spin_lock()+spin_unlock() is done.
>+ * To prevent the compiler/cpu temporarily writing 0 to use_global_lock,
>+ * READ_ONCE()/WRITE_ONCE() is used.
>  *
>  * 2) queue.status: (SEM_BARRIER_2)
>  * Initialization is done while holding sem_lock(), so no further barrier is
>@@ -342,10 +344,10 @@ static void complexmode_enter(struct sem_array *sma)
> 		 * Nothing to do, just reset the
> 		 * counter until we return to simple mode.
> 		 */
>-		sma->use_global_lock = USE_GLOBAL_LOCK_HYSTERESIS;
>+		WRITE_ONCE(sma->use_global_lock, USE_GLOBAL_LOCK_HYSTERESIS);
> 		return;
> 	}
>-	sma->use_global_lock = USE_GLOBAL_LOCK_HYSTERESIS;
>+	WRITE_ONCE(sma->use_global_lock, USE_GLOBAL_LOCK_HYSTERESIS);
>
> 	for (i = 0; i < sma->sem_nsems; i++) {
> 		sem = &sma->sems[i];
>@@ -371,7 +373,8 @@ static void complexmode_tryleave(struct sem_array *sma)
> 		/* See SEM_BARRIER_1 for purpose/pairing */
> 		smp_store_release(&sma->use_global_lock, 0);
> 	} else {
>-		sma->use_global_lock--;
>+		WRITE_ONCE(sma->use_global_lock,
>+				sma->use_global_lock-1);
> 	}
> }
>
>@@ -412,7 +415,7 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
> 	 * Initial check for use_global_lock. Just an optimization,
> 	 * no locking, no memory barrier.
> 	 */
>-	if (!sma->use_global_lock) {
>+	if (!READ_ONCE(sma->use_global_lock)) {
> 		/*
> 		 * It appears that no complex operation is around.
> 		 * Acquire the per-semaphore lock.
>-- 
>2.31.1
>