linux-kernel - Re: [PATCH] timers/migration: Fix ignored event due to missing CPU update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87r0fo9jmw.fsf@somnus>
Date: Tue, 02 Apr 2024 11:52:23 +0200
From: Anna-Maria Behnsen <anna-maria@...utronix.de>
To: Frederic Weisbecker <frederic@...nel.org>, Thomas Gleixner
 <tglx@...utronix.de>, Ingo Molnar <mingo@...nel.org>
Cc: LKML <linux-kernel@...r.kernel.org>, Frederic Weisbecker
 <frederic@...nel.org>
Subject: Re: [PATCH] timers/migration: Fix ignored event due to missing CPU
 update

Frederic Weisbecker <frederic@...nel.org> writes:

> When a group event is updated with its expiry unchanged but a different
> CPU, that target change may go unnoticed and the event may be propagated
> up with a stale CPU value. The following depicts a scenario that has
> been actually observed:

urgh...

>
> Signed-off-by: Frederic Weisbecker <frederic@...nel.org>
> ---
>  kernel/time/timer_migration.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/time/timer_migration.c b/kernel/time/timer_migration.c
> index c63a0afdcebe..90786bb9a607 100644
> --- a/kernel/time/timer_migration.c
> +++ b/kernel/time/timer_migration.c
> @@ -762,8 +762,11 @@ bool tmigr_update_events(struct tmigr_group *group, struct tmigr_group *child,
>  	 * queue when the expiry time changed only or when it could be ignored.
>  	 */
>  	if (timerqueue_node_queued(&evt->nextevt)) {
> -		if ((evt->nextevt.expires == nextexp) && !evt->ignore)
> +		if ((evt->nextevt.expires == nextexp) && !evt->ignore) {
> +			if (evt->cpu != first_childevt->cpu)
> +				evt->cpu = first_childevt->cpu;

Why not just unconditionally overwriting the evt->cpu value here?

>  			goto check_toplvl;
> +		}
>  
>  		if (!timerqueue_del(&group->events, &evt->nextevt))
>  			WRITE_ONCE(group->next_expiry, KTIME_MAX);

Thanks,

        Anna-Maria