linux-kernel - Re: [PATCH] tracing/timerlat: Check tlat_var for NULL in timerlat_fd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAP4=nvQPPd5nb3ao4tc9dCyd+fy30wX6=dziFEJ_AyaJOpnCmQ@mail.gmail.com>
Date: Thu, 5 Sep 2024 12:38:37 +0200
From: Tomas Glozar <tglozar@...hat.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: linux-trace-kernel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	jkacur@...hat.com, "Luis Claudio R. Goncalves" <lgoncalv@...hat.com>
Subject: Re: [PATCH] tracing/timerlat: Check tlat_var for NULL in timerlat_fd_release

st 4. 9. 2024 v 16:23 odesílatel Steven Rostedt <rostedt@...dmis.org> napsal:
>
> When running my tests, the second one would end up deadlocking and
> triggering lockdep. I found a way to do basically the same thing with a
> cpumask and no added locking. I'm currently testing it and will be sending
> out a patch later today (if it passes the tests).
>
> -- Steve
>

Oh that's unfortunate. Your cpumask patch does protect from timerlat
trying to stop a user workload thread via kthread_stop, but I don't
think it prevents this race in the code from the other patch:

static int timerlat_fd_release(struct inode *inode, struct file *file)
{
    ...
    mutex_lock(&interface_lock);
    <-- this can now run at the same time as tlat_var_reset(), since
the latter is not done under interface_lock in the latest version
    ...
if (tlat_var->kthread)
        <-- if tlat_var is zeroed here, we still panic on NULL dereference
hrtimer_cancel(&tlat_var->timer);
    ...
}

Either way, the results are much better: before, the kernel panicked
in <10 iterations of the while loop of the reproducer; with the
cpumask patch and the tlat_var->kthread check patch, it has been
running on my test VM for a few hours already with no panic.

Tomas