linux-kernel - Re: [PATCH v5] devcoredump : Serialize devcd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Jul 2022 18:03:59 +0530
From:   Mukesh Ojha <quic_mojha@...cinc.com>
To:     Johannes Berg <johannes@...solutions.net>
CC:     <linux-kernel@...r.kernel.org>, <tglx@...utronix.de>,
        <sboyd@...nel.org>, <rafael@...nel.org>, <keescook@...omium.org>,
        Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [PATCH v5] devcoredump : Serialize devcd_del work

Gentle reminder for review.

-Mukesh

On 7/1/2022 8:23 PM, Mukesh Ojha wrote:
> Thanks @greg.
> 
> Hi @johannes,
> 
> Could you review this patch?
> 
> -Mukesh
> 
> On 6/27/2022 6:41 PM, Greg KH wrote:
>> On Fri, May 27, 2022 at 07:33:40PM +0530, Mukesh Ojha wrote:
>>> In following scenario(diagram), when one thread X running 
>>> dev_coredumpm()
>>> adds devcd device to the framework which sends uevent notification to
>>> userspace and another thread Y reads this uevent and call to
>>> devcd_data_write() which eventually try to delete the queued timer that
>>> is not initialized/queued yet.
>>>
>>> So, debug object reports some warning and in the meantime, timer is
>>> initialized and queued from X path. and from Y path, it gets 
>>> reinitialized
>>> again and timer->entry.pprev=NULL and try_to_grab_pending() stucks.
>>>
>>> To fix this, introduce mutex and a boolean flag to serialize the 
>>> behaviour.
>>>
>>>       cpu0(X)                            cpu1(Y)
>>>
>>>      dev_coredump() uevent sent to user space
>>>      device_add()  ======================> user space process Y reads 
>>> the
>>>                                            uevents writes to devcd fd
>>>                                            which results into writes to
>>>
>>>                                           devcd_data_write()
>>>                                             mod_delayed_work()
>>>                                               try_to_grab_pending()
>>>                                                 del_timer()
>>>                                                   debug_assert_init()
>>>     INIT_DELAYED_WORK()
>>>     schedule_delayed_work()
>>>                                                     debug_object_fixup()
>>>                                                       
>>> timer_fixup_assert_init()
>>>                                                         timer_setup()
>>>                                                           
>>> do_init_timer()
>>>                                                         /*
>>>                                                          Above call 
>>> reinitializes
>>>                                                          the timer to
>>>                                                          
>>> timer->entry.pprev=NULL
>>>                                                          and this 
>>> will be checked
>>>                                                          later in 
>>> timer_pending() call.
>>>                                                         */
>>>                                                   timer_pending()
>>>                                                    
>>> !hlist_unhashed_lockless(&timer->entry)
>>>                                                      !h->pprev
>>>                                                  /*
>>>                                                    del_timer() checks 
>>> h->pprev and finds
>>>                                                    it to be NULL due 
>>> to which
>>>                                                    
>>> try_to_grab_pending() stucks.
>>>                                                  */
>>>
>>> Link: 
>>> https://lore.kernel.org/lkml/2e1f81e2-428c-f11f-ce92-eb11048cb271@quicinc.com/ 
>>>
>>> Signed-off-by: Mukesh Ojha <quic_mojha@...cinc.com>
>>> ---
>>
>> I need an ack from the devcoredump maintainer before I can take this...
>>
>> thanks,
>>
>> greg k-h