linux-kernel - Re: [PATCH] rcu/segcblist: Use WRITE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d1cee525-84c4-41f8-8594-0643d532e3ff@paulmck-laptop>
Date: Thu, 11 Sep 2025 06:17:47 -0700
From: "Paul E. McKenney" <paulmck@...nel.org>
To: Kaushlendra Kumar <kaushlendra.kumar@...el.com>
Cc: dave@...olabs.net, josh@...htriplett.org, frederic@...nel.org,
	neeraj.upadhyay@...nel.org, rostedt@...dmis.org,
	linux-kernel@...r.kernel.org, rcu@...r.kernel.org
Subject: Re: [PATCH] rcu/segcblist: Use WRITE_ONCE() for rclp->len decrement

On Thu, Sep 11, 2025 at 10:40:09AM +0530, Kaushlendra Kumar wrote:
> The rclp->len field is accessed concurrently by multiple contexts
> in RCU operations. Using WRITE_ONCE() provides the necessary memory
> ordering guarantees.

Could you please be specific here?  What calls to rcu_cblist_dequeue()
are such that hte ->qlen field can be concurrently accessed?

(Full disclosure: I don't see any, and KCSAN hasn't found any.  Of course,
that does not necessarily mean that there is no concurrent access.
But we need such concurrent access called out explicitly here, because
it might well be that the concurrent access is itself the bug.)

							Thanx, Paul

> This change ensures that the callback list length is updated atomically
> and provides consistent visibility across different CPU contexts,
> maintaining the integrity of RCU callback list management.
> 
> Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@...el.com>
> ---
>  kernel/rcu/rcu_segcblist.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/rcu/rcu_segcblist.c b/kernel/rcu/rcu_segcblist.c
> index 1693ea22ef1b..e10b36e9de54 100644
> --- a/kernel/rcu/rcu_segcblist.c
> +++ b/kernel/rcu/rcu_segcblist.c
> @@ -71,7 +71,7 @@ struct rcu_head *rcu_cblist_dequeue(struct rcu_cblist *rclp)
>  	rhp = rclp->head;
>  	if (!rhp)
>  		return NULL;
> -	rclp->len--;
> +	WRITE_ONCE(rclp->len, rclp->len - 1);
>  	rclp->head = rhp->next;
>  	if (!rclp->head)
>  		rclp->tail = &rclp->head;
> -- 
> 2.34.1
>