linux-kernel - Re: [PATCH next v2 4/5] locking/osq_lock: Avoid writing to node->next in the osq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 2 Jan 2024 10:47:16 +0100
From: Ingo Molnar <mingo@...nel.org>
To: David Laight <David.Laight@...lab.com>
Cc: "'linux-kernel@...r.kernel.org'" <linux-kernel@...r.kernel.org>,
	"'peterz@...radead.org'" <peterz@...radead.org>,
	"'longman@...hat.com'" <longman@...hat.com>,
	"'mingo@...hat.com'" <mingo@...hat.com>,
	"'will@...nel.org'" <will@...nel.org>,
	"'boqun.feng@...il.com'" <boqun.feng@...il.com>,
	'Linus Torvalds' <torvalds@...ux-foundation.org>,
	"'virtualization@...ts.linux-foundation.org'" <virtualization@...ts.linux-foundation.org>,
	'Zeng Heng' <zengheng4@...wei.com>
Subject: Re: [PATCH next v2 4/5] locking/osq_lock: Avoid writing to
 node->next in the osq_lock() fast path.


* David Laight <David.Laight@...LAB.COM> wrote:

> When osq_lock() returns false or osq_unlock() returns static
> analysis shows that node->next should always be NULL.
> This means that it isn't necessary to explicitly set it to NULL
> prior to atomic_xchg(&lock->tail, curr) on extry to osq_lock().
> 
> Just in case there a non-obvious race condition that can leave it
> non-NULL check with WARN_ON_ONCE() and NULL if set.
> Note that without this check the fast path (adding at the list head)
> doesn't need to to access the per-cpu osq_node at all.
> 
> Signed-off-by: David Laight <david.laight@...lab.com>
> ---
>  kernel/locking/osq_lock.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c
> index 27324b509f68..35bb99e96697 100644
> --- a/kernel/locking/osq_lock.c
> +++ b/kernel/locking/osq_lock.c
> @@ -87,12 +87,17 @@ osq_wait_next(struct optimistic_spin_queue *lock,
>  
>  bool osq_lock(struct optimistic_spin_queue *lock)
>  {
> -	struct optimistic_spin_node *node = this_cpu_ptr(&osq_node);
> -	struct optimistic_spin_node *prev, *next;
> +	struct optimistic_spin_node *node, *prev, *next;
>  	int curr = encode_cpu(smp_processor_id());
>  	int prev_cpu;
>  
> -	node->next = NULL;
> +	/*
> +	 * node->next should be NULL on entry.
> +	 * Check just in case there is a race somewhere.
> +	 * Note that this is probably an unnecessary cache miss in the fast path.
> +	 */
> +	if (WARN_ON_ONCE(raw_cpu_read(osq_node.next) != NULL))
> +		raw_cpu_write(osq_node.next, NULL);

The fix-uppery and explanation about something that shouldn't happen is 
excessive: please just put a plain WARN_ON_ONCE() here - which we can 
remove in a release or so.

Thanks,

	Ingo