netdev - Re: Question on ptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 16 Jan 2019 15:00:47 +0800
From:   fei phung <feiphung27@...il.com>
To:     mst@...hat.com, netdev@...r.kernel.org, feiphung@...mail.com
Subject: Re: Question on ptr_ring linux header

Hi,

> https://gist.github.com/promach/65e9331d55a43a2815239430a28e29c6#file-circ_ring-c-L62
> racy if there are multiple consumers.
> just call ptr_ring_consume_any.

If I modify pop_circ_queue() below to directly use
ptr_ring_consume_any() without
ptr_ring_empty_any() , I am afraid I am running into system crash due
to NULL pointer
deferencing for *item_pop:

          *item_pop = *((struct item *)ptr_ring_consume_any(buffer));

Just one silly beginner question, why will ptr_ring_empty_any() lead
to data race problem ?


inline int pop_circ_queue(struct ptr_ring * buffer, struct item * item_pop)
{
        DEBUG_MSG(KERN_INFO "Before pop, head = %u , tail = %u\n",
buffer->consumer_head, buffer->consumer_tail);

        /* extract one item struct containing two unsigned integers
from the buffer */
        *item_pop = *((struct item *)ptr_ring_consume_any(buffer));

        if((item_pop != NULL) && (item_pop->val1 > 0))
        {
        // val1 will never be zero since the event number starts from
1 (so, val1 in push_circ_queue() will not be zero, same case after
pop_circ_queue()), and 0 is only possible during initialization, not
during pop_circ_queue()

                DEBUG_MSG(KERN_INFO "val1 = %u , val2 = %u\n",
item_pop->val1, item_pop->val2);

                DEBUG_MSG(KERN_INFO "After pop, head = %u , tail =
%u\n", buffer->consumer_head, buffer->consumer_tail);

                return 0;
        }

        else {
                DEBUG_MSG(KERN_INFO "empty, nothing to pop from the ring\n");

                return 1;
        }
}



Regards,
Phung