linux-kernel - Re: [PATCH] llist: Use try_cmpxchg in llist_add_batch and llist_del

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAFULd4Ydo2BR3-kvHPeabzyHExW2GM3pfLiWa2uStrLDW52buA@mail.gmail.com>
Date:   Mon, 15 Aug 2022 21:28:29 +0200
From:   Uros Bizjak <ubizjak@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH] llist: Use try_cmpxchg in llist_add_batch and llist_del_first

On Mon, Aug 15, 2022 at 9:20 PM Uros Bizjak <ubizjak@...il.com> wrote:
>
> On Mon, Aug 15, 2022 at 3:48 AM Andrew Morton <akpm@...ux-foundation.org> wrote:
> >
> > On Tue, 12 Jul 2022 16:49:17 +0200 Uros Bizjak <ubizjak@...il.com> wrote:
> >
> > > Use try_cmpxchg instead of cmpxchg (*ptr, old, new) == old in
> > > llist_add_batch and llist_del_first. x86 CMPXCHG instruction returns
> > > success in ZF flag, so this change saves a compare after cmpxchg.
> > >
> > > Also, try_cmpxchg implicitly assigns old *ptr value to "old" when
> > > cmpxchg fails, enabling further code simplifications.
> > >
> > > No functional change intended.
> >
> > Well this is strange.  Your innocuous little patch:
>
> [...]
>
> > Does this:
> >
> > x1:/usr/src/25> size lib/llist.o-before lib/llist.o-after
> >    text    data     bss     dec     hex filename
> >     541      24       0     565     235 lib/llist.o-before
> >     940      24       0     964     3c4 lib/llist.o-after
> >
> > with x86_64 allmodconfig, gcc-11.1.0.
> >
> > No change with allnoconfig, some bloat with defconfig.
> >
> > I was too lazy to figure out why this happened, but it'd be great if
> > someone could investigate.  Something has gone wrong somewhere.
>
> Sanitizer is detecting a comparison with a constant and emits:
>
>  132:    f0 48 0f b1 2b           lock cmpxchg %rbp,(%rbx)
>  137:    41 0f 94 c6              sete   %r14b
>  13b:    31 ff                    xor    %edi,%edi
>  13d:    44 89 f6                 mov    %r14d,%esi
>  140:    e8 00 00 00 00           call   145 <llist_add_batch+0xc5>
>             141: R_X86_64_PLT32    __sanitizer_cov_trace_const_cmp1-0x4
>
> Since a new call is inserted, the compiler has to save all
> call-clobbered variables around the call, this triggers another call
> to __kasan_check_write. Finally, stack checking is emitted for patched

Actually, this second __kasan_check_write is for the write in case of
cmpxchg failure.

Uros.