linux-kernel - Re: [PATCH v3 1/2] wait_bit: do read barrier after testing a bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YuceB1x8twgpM7Bl@rowland.harvard.edu>
Date:   Sun, 31 Jul 2022 20:27:51 -0400
From:   Alan Stern <stern@...land.harvard.edu>
To:     Mikulas Patocka <mpatocka@...hat.com>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Will Deacon <will@...nel.org>,
        "Paul E. McKenney" <paulmck@...nel.org>,
        Ard Biesheuvel <ardb@...nel.org>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Andrea Parri <parri.andrea@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Boqun Feng <boqun.feng@...il.com>,
        Nicholas Piggin <npiggin@...il.com>,
        David Howells <dhowells@...hat.com>,
        Jade Alglave <j.alglave@....ac.uk>,
        Luc Maranget <luc.maranget@...ia.fr>,
        Akira Yokosawa <akiyks@...il.com>,
        Daniel Lustig <dlustig@...dia.com>,
        Joel Fernandes <joel@...lfernandes.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-arch <linux-arch@...r.kernel.org>,
        linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH v3 1/2] wait_bit: do read barrier after testing a bit

On Sun, Jul 31, 2022 at 04:40:59PM -0400, Mikulas Patocka wrote:
> wait_on_bit tests the bit without any memory barriers, consequently the
> code that follows wait_on_bit may be moved before testing the bit on
> architectures with weak memory ordering. When the code tests for some
> event using wait_on_bit and then performs a load operation, the load may
> be unexpectedly moved before wait_on_bit and it may return data that
> existed before the event occurred.
> 
> Such bugs exist in fs/buffer.c:__wait_on_buffer,
> drivers/md/dm-bufio.c:new_read,
> drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:dvb_usb_start_feed,
> drivers/bluetooth/btusb.c:btusb_mtk_hci_wmt_sync
> and perhaps in other places.
> 
> We fix this class of bugs by adding a read barrier after test_bit().
> 
> Signed-off-by: Mikulas Patocka <mpatocka@...hat.com>
> Cc: stable@...r.kernel.org
> 
> Index: linux-2.6/include/linux/wait_bit.h
> ===================================================================
> --- linux-2.6.orig/include/linux/wait_bit.h
> +++ linux-2.6/include/linux/wait_bit.h
> @@ -71,8 +71,10 @@ static inline int
>  wait_on_bit(unsigned long *word, int bit, unsigned mode)
>  {
>  	might_sleep();
> -	if (!test_bit(bit, word))
> +	if (!test_bit(bit, word)) {
> +		smp_rmb();

Any new code using smp_rmb or an acquire access should always include a 
comment that explains where the matching smp_wmb or release access is.

Alan Stern

>  		return 0;
> +	}
>  	return out_of_line_wait_on_bit(word, bit,
>  				       bit_wait,
>  				       mode);
> @@ -96,8 +98,10 @@ static inline int
>  wait_on_bit_io(unsigned long *word, int bit, unsigned mode)
>  {
>  	might_sleep();
> -	if (!test_bit(bit, word))
> +	if (!test_bit(bit, word)) {
> +		smp_rmb();
>  		return 0;
> +	}
>  	return out_of_line_wait_on_bit(word, bit,
>  				       bit_wait_io,
>  				       mode);
> @@ -123,8 +127,10 @@ wait_on_bit_timeout(unsigned long *word,
>  		    unsigned long timeout)
>  {
>  	might_sleep();
> -	if (!test_bit(bit, word))
> +	if (!test_bit(bit, word)) {
> +		smp_rmb();
>  		return 0;
> +	}
>  	return out_of_line_wait_on_bit_timeout(word, bit,
>  					       bit_wait_timeout,
>  					       mode, timeout);
> @@ -151,8 +157,10 @@ wait_on_bit_action(unsigned long *word,
>  		   unsigned mode)
>  {
>  	might_sleep();
> -	if (!test_bit(bit, word))
> +	if (!test_bit(bit, word)) {
> +		smp_rmb();
>  		return 0;
> +	}
>  	return out_of_line_wait_on_bit(word, bit, action, mode);
>  }
>  
> Index: linux-2.6/kernel/sched/wait_bit.c
> ===================================================================
> --- linux-2.6.orig/kernel/sched/wait_bit.c
> +++ linux-2.6/kernel/sched/wait_bit.c
> @@ -51,6 +51,8 @@ __wait_on_bit(struct wait_queue_head *wq
>  
>  	finish_wait(wq_head, &wbq_entry->wq_entry);
>  
> +	smp_rmb();
> +
>  	return ret;
>  }
>  EXPORT_SYMBOL(__wait_on_bit);
>