linux-kernel - Re: [PATCH] llist: Use try_cmpxchg in llist_add_batch and llist_del

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFULd4YuYhNmhx3tBwBeR=ascfy=BZfZKk4e7vMq6gy06zk41Q@mail.gmail.com>
Date:   Mon, 15 Aug 2022 21:20:46 +0200
From:   Uros Bizjak <ubizjak@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH] llist: Use try_cmpxchg in llist_add_batch and llist_del_first

On Mon, Aug 15, 2022 at 3:48 AM Andrew Morton <akpm@...ux-foundation.org> wrote:
>
> On Tue, 12 Jul 2022 16:49:17 +0200 Uros Bizjak <ubizjak@...il.com> wrote:
>
> > Use try_cmpxchg instead of cmpxchg (*ptr, old, new) == old in
> > llist_add_batch and llist_del_first. x86 CMPXCHG instruction returns
> > success in ZF flag, so this change saves a compare after cmpxchg.
> >
> > Also, try_cmpxchg implicitly assigns old *ptr value to "old" when
> > cmpxchg fails, enabling further code simplifications.
> >
> > No functional change intended.
>
> Well this is strange.  Your innocuous little patch:

[...]

> Does this:
>
> x1:/usr/src/25> size lib/llist.o-before lib/llist.o-after
>    text    data     bss     dec     hex filename
>     541      24       0     565     235 lib/llist.o-before
>     940      24       0     964     3c4 lib/llist.o-after
>
> with x86_64 allmodconfig, gcc-11.1.0.
>
> No change with allnoconfig, some bloat with defconfig.
>
> I was too lazy to figure out why this happened, but it'd be great if
> someone could investigate.  Something has gone wrong somewhere.

Sanitizer is detecting a comparison with a constant and emits:

 132:    f0 48 0f b1 2b           lock cmpxchg %rbp,(%rbx)
 137:    41 0f 94 c6              sete   %r14b
 13b:    31 ff                    xor    %edi,%edi
 13d:    44 89 f6                 mov    %r14d,%esi
 140:    e8 00 00 00 00           call   145 <llist_add_batch+0xc5>
            141: R_X86_64_PLT32    __sanitizer_cov_trace_const_cmp1-0x4

Since a new call is inserted, the compiler has to save all
call-clobbered variables around the call, this triggers another call
to __kasan_check_write. Finally, stack checking is emitted for patched
functions.

Without sanitizer (make defconfig), the code is as expected, with a
couple of bytes saved due to unneeded mov/cmp.

Uros.