linux-kernel - Re: [PATCH -next 2/5] blk-iocost: don't release 'ioc->lock' while updating params

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 Oct 2022 06:56:50 -1000
From:   Tejun Heo <tj@...nel.org>
To:     Yu Kuai <yukuai1@...weicloud.com>
Cc:     axboe@...nel.dk, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org, yukuai3@...wei.com,
        yi.zhang@...wei.com
Subject: Re: [PATCH -next 2/5] blk-iocost: don't release 'ioc->lock' while
 updating params

On Tue, Oct 11, 2022 at 04:35:44PM +0800, Yu Kuai wrote:
> From: Yu Kuai <yukuai3@...wei.com>
> 
> ioc_qos_write() and ioc_cost_model_write() are the same:
> 
> 1) hold lock to read 'ioc->params' to local variable;
> 2) update params to local variable without lock;
> 3) hold lock to write local variable to 'ioc->params';
> 
> In theroy, if user updates params concurrenty, the params might be lost:
> 
> t1: update params a		t2: update params b
> spin_lock_irq(&ioc->lock);
> memcpy(qos, ioc->params.qos, sizeof(qos))
> spin_unlock_irq(&ioc->lock);
> 
> qos[a] = xxx;
> 
> 				spin_lock_irq(&ioc->lock);
> 				memcpy(qos, ioc->params.qos, sizeof(qos))
> 				spin_unlock_irq(&ioc->lock);
> 
> 				qos[b] = xxx;
> 
> spin_lock_irq(&ioc->lock);
> memcpy(ioc->params.qos, qos, sizeof(qos));
> ioc_refresh_params(ioc, true);
> spin_unlock_irq(&ioc->lock);
> 
> 				spin_lock_irq(&ioc->lock);
> 				// updates of a will be lost
> 				memcpy(ioc->params.qos, qos, sizeof(qos));
> 				ioc_refresh_params(ioc, true);
> 				spin_unlock_irq(&ioc->lock);
> 
> Althrough this is not common case, the problem can by fixed easily by
> holding the lock through the read, update, write process.
> 
> Signed-off-by: Yu Kuai <yukuai3@...wei.com>

Acked-by: Tejun Heo <tj@...nel.org>

Thanks.

-- 
tejun