netdev - Re: wrong smp_mb__after_atomic() in tcp_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170123171828.GA2476@redhat.com>
Date:   Mon, 23 Jan 2017 18:18:28 +0100
From:   Oleg Nesterov <oleg@...hat.com>
To:     Jason Baron <jbaron@...mai.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Herbert Xu <herbert.xu@...hat.com>,
        Yauheni Kaliuta <yauheni.kaliuta@...hat.com>,
        netdev@...r.kernel.org, Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: wrong smp_mb__after_atomic() in tcp_check_space() ?

On 01/23, Jason Baron wrote:
>
> >It was added by 3c7151275c0c9a "tcp: add memory barriers to write space paths"
> >and the patch looks correct in that we need the barriers in tcp_check_space()
> >and tcp_poll() in theory, so it seems tcp_check_space() needs smp_mb() ?
> >
>
> Yes, I think it should be upgraded to an smp_mb() there. If you agree with
> this analysis, I will send a patch to upgrade it.

I think this makes sense, if nothing else to remove the obviously wrong
smp_mb__after_atomic() ;)

> Note, I did not actually
> run into this race in practice.

Yes, I am not sure it is actually necessary in practice, and even if
tcp_check_space() races with tcp_poll() and misses SOCK_NOSPACE it should
be probably called again later, but I know nothing about networking code.

We noticed this by accident, we have a bug report which really looks as a
missed wakeup in epoll, but this kernel is old and in particular it lacks
the commit 128dd1759 "epoll: prevent missed events on EPOLL_CTL_MOD" which
looks more promising. But we are not sure it can fully explain the problem
we can't reproduce, so we are looking for anything else which may contribute
to the problem.

Oleg.