linux-kernel - Re: [PATCH next v2 2/2] printk: fix cpu lock ordering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 08 Jun 2021 16:18:51 +0200
From:   John Ogness <john.ogness@...utronix.de>
To:     Petr Mladek <pmladek@...e.com>
Cc:     Sergey Senozhatsky <senozhatsky@...omium.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        linux-kernel@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        "Paul E. McKenney" <paulmck@...nel.org>
Subject: Re: [PATCH next v2 2/2] printk: fix cpu lock ordering

On 2021-06-08, Petr Mladek <pmladek@...e.com> wrote:
> The change makes perfect sense and the code looks correct.
> But I am not sure about the description of the memory barriers.

OK.

>> diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
>> index f94babb38493..8c870581cfb4 100644
>> --- a/kernel/printk/printk.c
>> +++ b/kernel/printk/printk.c
>> @@ -3560,10 +3560,29 @@ void printk_cpu_lock_irqsave(bool *lock_flag, unsigned long *irq_flags)
>>  
>>  	cpu = smp_processor_id();
>>  
>> -	old = atomic_cmpxchg(&printk_cpulock_owner, -1, cpu);
>> +	/*
>> +	 * Guarantee loads and stores from the previous lock owner are
>> +	 * visible to this CPU once it is the lock owner. This pairs
>> +	 * with cpu_unlock:B.
>
> These things are not easy to describe. It took me quite some time to
> understand the above description. And think that it does not say
> the full storry.
>
> IMHO, the lock should work the way that:
>
>    + The new owner see all writes done or seen by the previous owner(s).
>    + The previous owner(s) never see writes done by the new owner.

You are right. I can describe those independently.

> Honestly, I am not sure if we could describe the barriers correctly
> and effectively at the same time.

For v3 I would describe the 2 cases separately. For lock/acquire:

	/*
	 * Guarantee loads and stores from this CPU when it is the lock owner
	 * are _not_ visible to the previous lock owner. This pairs with
	 * cpu_unlock:B.
	 *
	 * Memory barrier involvement:
	 *
	 * If cpu_lock:A reads from cpu_unlock:B, then cpu_unlock:A can never
	 * read from cpu_lock:B.
	 *
	 * Relies on:
	 *
	 * RELEASE from cpu_unlock:A to cpu_unlock:B
	 *    matching
	 * ACQUIRE from cpu_lock:A to cpu_lock:B
	 */

And for unlock/release:

	/*
	 * Guarantee loads and stores from this CPU when it was the
	 * lock owner are visible to the next lock owner. This pairs
	 * with cpu_lock:A.
	 *
	 * Memory barrier involvement:
	 *
	 * If cpu_lock:A reads from cpu_unlock:B, then cpu_lock:B
	 * reads from cpu_unlock:A.
	 *
	 * Relies on:
	 *
	 * RELEASE from cpu_unlock:A to cpu_unlock:B
	 *    matching
	 * ACQUIRE from cpu_lock:A to cpu_lock:B
	 */

I know you are not a fan of these drawn out memory barrier comments. But
it really simplifies verification and translation to litmus
tests. Without such comments, I would be lost looking back at
printk_ringbuffer.c.

If the previous dump_stack() cpu lock implementation had such comments,
we would know if the missing memory barriers were by design.

John Ogness