linux-kernel - Re: [PATCH] cpufreq: Fix the race condition while updating the transition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 28 Aug 2023 14:22:48 +0530
From:   Viresh Kumar <viresh.kumar@...aro.org>
To:     "Liao, Chang" <liaochang1@...wei.com>
Cc:     rafael@...nel.org, srivatsa.bhat@...ux.vnet.ibm.com,
        linux-pm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] cpufreq: Fix the race condition while updating the
 transition_task of policy

On 28-08-23, 16:29, Liao, Chang wrote:
> Task B does not necessarily go to sleep when it calls wait_event(), it depends on
> the condition to wait for evaluate false or not. So there is a small race window
> where Task A already set 'transition_ongoing' to false and Task B can cross wait_event()
> immediately.
> 
> wait_event:
> do {
> 	might_sleep();
> 	if (condition) // !transition_ongoing
> 		break;
> 	__wait_event();
> };
> 
> I hope I do not miss something important in the code above.
 
> Yes, if the CPU uses weak memroy model, it is possible for the instructions to be reordered.
> therefore, it is a good idea to insert an smb() between these two lines if there is race here.

Maybe it would be better to do this instead ?

diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 6b52ebe5a890..f11b01b25e8d 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -455,8 +455,10 @@ void cpufreq_freq_transition_end(struct cpufreq_policy *policy,
                            policy->cur,
                            policy->cpuinfo.max_freq);

+       spin_lock(&policy->transition_lock);
        policy->transition_ongoing = false;
        policy->transition_task = NULL;
+       spin_unlock(&policy->transition_lock);

        wake_up(&policy->transition_wait);
 }

-- 
viresh