linux-kernel - Re: [patch V3 01/18] posix-timers: Ensure that timer initialization is fully visible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z8y5DSKIsjL6QsJe@pavilion.home>
Date: Sat, 8 Mar 2025 22:39:25 +0100
From: Frederic Weisbecker <frederic@...nel.org>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: LKML <linux-kernel@...r.kernel.org>,
	Anna-Maria Behnsen <anna-maria@...utronix.de>,
	Benjamin Segall <bsegall@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Andrey Vagin <avagin@...nvz.org>,
	Pavel Tikhomirov <ptikhomirov@...tuozzo.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Cyrill Gorcunov <gorcunov@...il.com>
Subject: Re: [patch V3 01/18] posix-timers: Ensure that timer initialization
 is fully visible

Le Sat, Mar 08, 2025 at 05:48:10PM +0100, Thomas Gleixner a écrit :
> Frederic pointed out that the memory operations to initialize the timer are
> not guaranteed to be visible, when __lock_timer() observes timer::it_signal
> valid under timer::it_lock:
> 
>   T0                                      T1
>   ---------                               -----------
>   do_timer_create()
>       // A
>       new_timer->.... = ....
>       spin_lock(current->sighand)
>       // B
>       WRITE_ONCE(new_timer->it_signal, current->signal)
>       spin_unlock(current->sighand)
> 					sys_timer_*()
> 					   t =  __lock_timer()
> 						  spin_lock(&timr->it_lock)
> 						  // observes B
> 						  if (timr->it_signal == current->signal)
> 						    return timr;
> 			                   if (!t)
> 					       return;
> 					// Is not guaranteed to observe A
> 
> Protect the write of timer::it_signal, which makes the timer valid, with
> timer::it_lock as well. This guarantees that T1 must observe the
> initialization A completely, when it observes the valid signal pointer
> under timer::it_lock. sighand::siglock must still be taken to protect the
> signal::posix_timers list.
> 
> Reported-by: Frederic Weisbecker <frederic@...nel.org>
> Suggested-by: Frederic Weisbecker <frederic@...nel.org>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>

Reviewed-by: Frederic Weisbecker <frederic@...nel.org>