linux-kernel - Re: [PATCH] ipc/sem: do not sleep with a spin lock held

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63840bf3-2199-3240-bdfa-abb55518b5f9@colorfullife.com>
Date:   Wed, 22 Dec 2021 12:45:33 +0100
From:   Manfred Spraul <manfred@...orfullife.com>
To:     cgel.zte@...il.com, akpm@...ux-foundation.org
Cc:     vvs@...tuozzo.com, shakeelb@...gle.com, rdunlap@...radead.org,
        dbueso@...e.de, unixbhaskar@...il.com, chi.minghao@....com.cn,
        arnd@...db.de, linux-kernel@...r.kernel.org,
        Zeal Robot <zealci@....com.cn>
Subject: Re: [PATCH] ipc/sem: do not sleep with a spin lock held

Hi Minghao,

On 12/22/21 09:10, cgel.zte@...il.com wrote:
> From: Minghao Chi <chi.minghao@....com.cn>
>
> We can't call kvfree() with a spin lock held, so defer it.
>
> Reported-by: Zeal Robot <zealci@....com.cn>
> Signed-off-by: Minghao Chi <chi.minghao@....com.cn>

Could you add

Fixes: fc37a3b8b438 ("[PATCH] ipc sem: use kvmalloc for sem_undo 
allocation")

Cc: stable@...r.kernel.org

I will review/test the change in the next few days.

Especially, I would like to check if there are further instances where 
the same mistake was made.

> /**
> * kvfree() - Free memory.
> * @addr: Pointer to allocated memory.
> *
> * kvfree frees memory allocated by any of vmalloc(), kmalloc() or 
> kvmalloc().
> * It is slightly more efficient to use kfree() or vfree() if you are 
> certain
> * that you know which one to use.
> *
> * Context: Either preemptible task context or not-NMI interrupt.
> */
>
As an independent change: Should we add a


       might_sleep_if(!in_interrupt());

into kvfree(), to trigger bugs more easily?

> ---
>   ipc/sem.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/ipc/sem.c b/ipc/sem.c
> index 6693daf4fe11..0dbdb98fdf2d 100644
> --- a/ipc/sem.c
> +++ b/ipc/sem.c
> @@ -1964,6 +1964,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
>   	 */
>   	un = lookup_undo(ulp, semid);
>   	if (un) {
> +		spin_unlock(&ulp->lock);
>   		kvfree(new);
>   		goto success;
>   	}
> @@ -1976,9 +1977,8 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
>   	ipc_assert_locked_object(&sma->sem_perm);
>   	list_add(&new->list_id, &sma->list_id);
>   	un = new;
> -
> -success:
>   	spin_unlock(&ulp->lock);
> +success:
>   	sem_unlock(sma, -1);
>   out:
>   	return un;