linux-kernel - Re: [RESEND PATCH] fs/pipe: Introduce a check to skip sleeping processes during pipe read/write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241228143248.GB5302@redhat.com>
Date: Sat, 28 Dec 2024 15:32:49 +0100
From: Oleg Nesterov <oleg@...hat.com>
To: Manfred Spraul <manfred@...orfullife.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>, viro@...iv.linux.org.uk,
	brauner@...nel.org, jack@...e.cz, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, oliver.sang@...el.com,
	ebiederm@...ssion.com, colin.king@...onical.com,
	josh@...htriplett.org, penberg@...helsinki.fi, mingo@...e.hu,
	jes@....com, hch@....de, aia21@...tab.net, arjan@...radead.org,
	jgarzik@...ox.com, neukum@...hschaft.cup.uni-muenchen.de,
	oliver@...kum.name, dada1@...mosbay.com, axboe@...nel.dk,
	axboe@...e.de, nickpiggin@...oo.com.au, dhowells@...hat.com,
	nathans@....com, rolandd@...co.com, tytso@....edu, bunk@...sta.de,
	pbadari@...ibm.com, ak@...ux.intel.com, ak@...e.de,
	davem@...emloft.net, jsipek@...sunysb.edu, jens.axboe@...cle.com,
	ramsdell@...re.org, hch@...radead.org, akpm@...ux-foundation.org,
	randy.dunlap@...cle.com, efault@....de, rdunlap@...radead.org,
	haveblue@...ibm.com, drepper@...hat.com, dm.n9107@...il.com,
	jblunck@...e.de, davidel@...ilserver.org,
	mtk.manpages@...glemail.com, linux-arch@...r.kernel.org,
	vda.linux@...glemail.com, jmorris@...ei.org, serue@...ibm.com,
	hca@...ux.ibm.com, rth@...ddle.net, lethal@...ux-sh.org,
	tony.luck@...el.com, heiko.carstens@...ibm.com, andi@...stfloor.org,
	corbet@....net, crquan@...il.com, mszeredi@...e.cz,
	miklos@...redi.hu, peterz@...radead.org, a.p.zijlstra@...llo.nl,
	earl_chew@...lent.com, npiggin@...il.com, npiggin@...e.de,
	julia@...u.dk, jaxboe@...ionio.com, nikai@...ai.net,
	dchinner@...hat.com, davej@...hat.com, npiggin@...nel.dk,
	eric.dumazet@...il.com, tim.c.chen@...ux.intel.com,
	xemul@...allels.com, tj@...nel.org, serge.hallyn@...onical.com,
	gorcunov@...nvz.org, bcrl@...ck.org, alan@...rguk.ukuu.org.uk,
	will.deacon@....com, will@...nel.org, zab@...hat.com, balbi@...com,
	gregkh@...uxfoundation.org, rusty@...tcorp.com.au,
	socketpair@...il.com, penguin-kernel@...ove.sakura.ne.jp,
	mhocko@...nel.org, axboe@...com, tglx@...utronix.de,
	mcgrof@...nel.org, linux@...inikbrodowski.net, willy@...radead.org,
	paulmck@...nel.org, kernel@...force.de,
	linux-morello@...lists.linaro.org
Subject: Re: [RESEND PATCH] fs/pipe: Introduce a check to skip sleeping
 processes during pipe read/write

On 12/27, Manfred Spraul wrote:
>
> >I _think_ that
> >
> >	wait_event_whatever(WQ, CONDITION);
> >vs
> >
> >	CONDITION = 1;
> >	if (wq_has_sleeper(WQ))
> >		wake_up_xxx(WQ, ...);
> >
> >is fine.
>
> This pattern is documented in wait.h:
>
> https://elixir.bootlin.com/linux/v6.12.6/source/include/linux/wait.h#L96
>
> Thus if there an issue, then the documentation should be updated.

Agreed, basically the same pattern, prepare_to_wait_event() is similar
to prepare_to_wait().

> But I do not understand this comment (from 2.6.0)
>
> https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/kernel/fork.c?h=v2.6.0&id=e220fdf7a39b54a758f4102bdd9d0d5706aa32a7
>
> >/* * Note: we use "set_current_state()" _after_ the wait-queue add, *
> >because we need a memory barrier there on SMP, so that any * wake-function
> >that tests for the wait-queue being active * will be guaranteed to see
> >waitqueue addition _or_ subsequent * tests in this thread will see the
> >wakeup having taken place. * * The spin_unlock() itself is semi-permeable
> >and only protects * one way (it only protects stuff inside the critical
> >region and * stops them from bleeding out - it would still allow
> >subsequent * loads to move into the the critical region). */
...
> set_current_state() now uses smp_store_mb(), which is a memory barrier
> _after_ the store.

And afaics this is what we actually need.

> Thus I do not see what enforces that the store happens
> before the store for the __add_wait_queue().

IIUC this is fine, no need to serialize list_add() and STORE(tsk->__state),
they can be reordered.

But we need mb() between __add_wait_queue + __set_current_state (in any
order) and the subsequent "if (CONDITION)" check.

> --- a/kernel/sched/wait.c
> +++ b/kernel/sched/wait.c
> @@ -124,6 +124,23 @@ static int __wake_up_common_lock(struct wait_queue_head *wq_head, unsigned int m
>  int __wake_up(struct wait_queue_head *wq_head, unsigned int mode,
>  	      int nr_exclusive, void *key)
>  {
> +	if (list_empty(&wq_head->head)) {
> +		struct list_head *pn;
> +
> +		/*
> +		 * pairs with spin_unlock_irqrestore(&wq_head->lock);
> +		 * We actually do not need to acquire wq_head->lock, we just
> +		 * need to be sure that there is no prepare_to_wait() that
> +		 * completed on any CPU before __wake_up was called.
> +		 * Thus instead of load_acquiring the spinlock and dropping
> +		 * it again, we load_acquire the next list entry and check
> +		 * that the list is not empty.
> +		 */
> +		pn = smp_load_acquire(&wq_head->head.next);
> +
> +		if(pn == &wq_head->head)
> +			return 0;
> +	}

Too subtle for me ;)

I have some concerns, but I need to think a bit more to (try to) actually
understand this change.

Oleg.