netdev - Re: [PATCH net-next 08/12] ptr_ring: prevent queue load/store tearing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1a069bf6-176c-375a-75fb-6cd9f5f9883b@redhat.com>
Date:   Fri, 26 Jan 2018 10:38:12 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     "Michael S. Tsirkin" <mst@...hat.com>, linux-kernel@...r.kernel.org
Cc:     netdev@...r.kernel.org, John Fastabend <john.fastabend@...il.com>,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH net-next 08/12] ptr_ring: prevent queue load/store tearing



On 2018年01月26日 07:36, Michael S. Tsirkin wrote:
> In theory compiler could tear queue loads or stores in two. It does not
> seem to be happening in practice but it seems easier to convert the
> cases where this would be a problem to READ/WRITE_ONCE than worry about
> it.
>
> Signed-off-by: Michael S. Tsirkin <mst@...hat.com>
> ---
>   include/linux/ptr_ring.h | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
> index 3a19ebd..1883d61 100644
> --- a/include/linux/ptr_ring.h
> +++ b/include/linux/ptr_ring.h
> @@ -114,7 +114,7 @@ static inline int __ptr_ring_produce(struct ptr_ring *r, void *ptr)
>   	/* Pairs with smp_read_barrier_depends in __ptr_ring_consume. */
>   	smp_wmb();
>   
> -	r->queue[r->producer++] = ptr;
> +	WRITE_ONCE(r->queue[r->producer++], ptr);
>   	if (unlikely(r->producer >= r->size))
>   		r->producer = 0;

You may want WRITE_ONCE() here? And if we just fix the out of bound 
r->producer, we may just need one WRITE_ONCE().

Thanks

>   	return 0;
> @@ -173,7 +173,7 @@ static inline int ptr_ring_produce_bh(struct ptr_ring *r, void *ptr)
>   static inline void *__ptr_ring_peek(struct ptr_ring *r)
>   {
>   	if (likely(r->size))
> -		return r->queue[r->consumer_head];
> +		return READ_ONCE(r->queue[r->consumer_head]);
>   	return NULL;
>   }
>