linux-kernel - Re: [patch V3 02/18] posix-timers: Initialise timer before adding it to the hash table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z9A5uixC_Tjk308w@localhost.localdomain>
Date: Tue, 11 Mar 2025 14:25:14 +0100
From: Frederic Weisbecker <frederic@...nel.org>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: LKML <linux-kernel@...r.kernel.org>,
	Anna-Maria Behnsen <anna-maria@...utronix.de>,
	Benjamin Segall <bsegall@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Andrey Vagin <avagin@...nvz.org>,
	Pavel Tikhomirov <ptikhomirov@...tuozzo.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Cyrill Gorcunov <gorcunov@...il.com>
Subject: Re: [patch V3 02/18] posix-timers: Initialise timer before adding it
 to the hash table

Le Sat, Mar 08, 2025 at 05:48:14PM +0100, Thomas Gleixner a écrit :
>  kernel/time/posix-timers.c |   56 +++++++++++++++++++++++++++++++++------------
>  1 file changed, 42 insertions(+), 14 deletions(-)
> 
> --- a/kernel/time/posix-timers.c
> +++ b/kernel/time/posix-timers.c
> @@ -72,13 +72,13 @@ static int hash(struct signal_struct *si
>  	return hash_32(hash32_ptr(sig) ^ nr, HASH_BITS(posix_timers_hashtable));
>  }
>  
> -static struct k_itimer *__posix_timers_find(struct hlist_head *head,
> -					    struct signal_struct *sig,
> -					    timer_t id)
> +static struct k_itimer *posix_timer_by_id(timer_t id)
>  {
> +	struct signal_struct *sig = current->signal;
> +	struct hlist_head *head = &posix_timers_hashtable[hash(sig, id)];
>  	struct k_itimer *timer;
>  
> -	hlist_for_each_entry_rcu(timer, head, t_hash, lockdep_is_held(&hash_lock)) {
> +	hlist_for_each_entry_rcu(timer, head, t_hash) {
>  		/* timer->it_signal can be set concurrently */
>  		if ((READ_ONCE(timer->it_signal) == sig) && (timer->it_id == id))
>  			return timer;
> @@ -86,12 +86,26 @@ static struct k_itimer *__posix_timers_f
>  	return NULL;
>  }
>  
> -static struct k_itimer *posix_timer_by_id(timer_t id)
> +static inline struct signal_struct *posix_sig_owner(const struct k_itimer *timer)
>  {
> -	struct signal_struct *sig = current->signal;
> -	struct hlist_head *head = &posix_timers_hashtable[hash(sig, id)];
> +	unsigned long val = (unsigned long)timer->it_signal;

When used from posix_timer_add() -> posix_timer_hashed(), it can race
with another do_timer_create() that clears the BIT 0. It's fine but
KCSAN is going to warn sooner or later.

It looks like a good candidate for data_race() ? Well, READ_ONCE() is
fine too.

Thanks.