linux-kernel - [PATCH 0/3] kthread_worker: Fix race between kthread_mod_delayed_work() and kthread_cancel_delayed_work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 10 Jun 2021 15:30:48 +0200
From:   Petr Mladek <pmladek@...e.com>
To:     Andrew Morton <akpm@...ux-foundation.org>,
        Martin Liu <liumartin@...gle.com>
Cc:     Oleg Nesterov <oleg@...hat.com>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Tejun Heo <tj@...nel.org>, minchan@...gle.com,
        davidchao@...gle.com, jenhaochen@...gle.com,
        clang-built-linux@...glegroups.com, linux-kernel@...r.kernel.org,
        Petr Mladek <pmladek@...e.com>
Subject: [PATCH 0/3] kthread_worker: Fix race between kthread_mod_delayed_work() and kthread_cancel_delayed_work_sync()

This patchset fixes the race between kthread_mod_delayed_work() and
kthread_cancel_delayed_work_sync() including proper return value
handling.

The original fix, from Martin Liu [1], opened discussion [2] about
the return value. It took me some time to realize that the original
patch was not a correct fix.

The problem is that the return value might be used for reference counting
of the queued works. The return value is boolean. It could distinguish
only two situations where the work is:

    + newly queued => inc(refcnt)                   (ret == false)
    + was queued, removed, added => nope(refcntn)   (ret == true)

The original fix, introduced another situation:

    + was queued, removed => dec(refcnt)   (ret == ???)

The proper solution is to remove the work from the list only when
it can be added again. Fortunately, it can be fixed relatively
easily. I have split it into 3 small steps.

[1] https://lore.kernel.org/r/20210513065458.941403-1-liumartin@google.com
[2] https://lore.kernel.org/r/20210520214737.MrGGKbPrJ%akpm@linux-foundation.org

Petr Mladek (3):
  kthread_worker: Split code for canceling the delayed work timer.
  kthread: Prevent deadlock when kthread_mod_delayed_work() races with
    kthread_cancel_delayed_work_sync()
  kthread_worker: Fix return value when kthread_mod_delayed_work() races
    with kthread_cancel_delayed_work_sync()

 kernel/kthread.c | 96 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 63 insertions(+), 33 deletions(-)

-- 
2.26.2