linux-kernel - Re: [PATCH] list: Fix another data-race around ep->rdllist.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20220327171530.sbx63nw7h72bjucw@offworld>
Date:   Sun, 27 Mar 2022 10:15:30 -0700
From:   Davidlohr Bueso <dave@...olabs.net>
To:     Kuniyuki Iwashima <kuniyu@...zon.co.jp>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Kuniyuki Iwashima <kuni1840@...il.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzbot+19480160ef25c9ffa29d@...kaller.appspotmail.com,
        Soheil Hassas Yeganeh <soheil@...gle.com>,
        Sridhar Samudrala <sridhar.samudrala@...el.com>,
        Alexander Duyck <alexander.h.duyck@...el.com>
Subject: Re: [PATCH] list: Fix another data-race around ep->rdllist.

On Sat, 26 Mar 2022, Kuniyuki Iwashima wrote:

>syzbot had reported another race around ep->rdllist.  ep_poll() calls
>list_empty_careful() locklessly to check if the list is empty or not
>by testing rdllist->prev == rdllist->next.
>
>When the list does not have any nodes, the next and prev arguments of
>__list_add() is the same head pointer.  Thus the write to head->prev
>there is racy with lockless list_empty_careful() and needs WRITE_ONCE()
>to avoid store-tearing.
>
>Note that the reader side is already fixed in the patch [0].
>
>[0]: https://lore.kernel.org/mm-commits/20220326031647.DD24EC004DD@smtp.kernel.org/
>
>BUG: KCSAN: data-race in do_epoll_ctl / do_epoll_wait

I think this needs to be part of the same list-fix-a-data-race-around-ep-rdllist.patch

Thanks,
Davidlohr