Manfred Spraul 5864a2fd30 ipc/sem.c: fix complex_count vs. simple op race ... Commit 6d07b68ce1 ("ipc/sem.c: optimize sem_lock()") introduced a race: sem_lock has a fast path that allows parallel simple operations. There are two reasons why a simple operation cannot run in parallel: - a non-simple operations is ongoing (sma->sem_perm.lock held) - a complex operation is sleeping (sma->complex_count != 0) As both facts are stored independently, a thread can bypass the current checks by sleeping in the right positions. See below for more details (or kernel bugzilla 105651). The patch fixes that by creating one variable (complex_mode) that tracks both reasons why parallel operations are not possible. The patch also updates stale documentation regarding the locking. With regards to stable kernels: The patch is required for all kernels that include the commit 6d07b68ce1 ("ipc/sem.c: optimize sem_lock()") (3.10?) The alternative is to revert the patch that introduced the race. The patch is safe for backporting, i.e. it makes no assumptions about memory barriers in spin_unlock_wait(). Background: Here is the race of the current implementation: Thread A: (simple op) - does the first "sma->complex_count == 0" test Thread B: (complex op) - does sem_lock(): This includes an array scan. But the scan can't find Thread A, because Thread A does not own sem->lock yet. - the thread does the operation, increases complex_count, drops sem_lock, sleeps Thread A: - spin_lock(&sem->lock), spin_is_locked(sma->sem_perm.lock) - sleeps before the complex_count test Thread C: (complex op) - does sem_lock (no array scan, complex_count==1) - wakes up Thread B. - decrements complex_count Thread A: - does the complex_count test Bug: Now both thread A and thread C operate on the same array, without any synchronization. Fixes: 6d07b68ce1 ("ipc/sem.c: optimize sem_lock()") Link: http://lkml.kernel.org/r/1469123695-5661-1-git-send-email-manfred@colorfullife.com Reported-by: <felixh@informatik.uni-bremen.de> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@elte.hu> Cc: <1vier1@web.de> Cc: <stable@vger.kernel.org> [3.10+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2016-10-11 15:06:33 -07:00
..
acpi	Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-10-03 19:43:08 -07:00
asm-generic	nmi_backtrace: generate one-line reports for idle cpus	2016-10-07 18:46:30 -07:00
clocksource
crypto	Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2016-10-10 11:19:47 +08:00
drm
dt-bindings	ARM: SoC: late DT updates for v4.9	2016-10-07 21:34:49 -07:00
keys
kvm	ARM: KVM: Support vgic-v3	2016-09-22 13:22:21 +02:00
linux	ipc/sem.c: fix complex_count vs. simple op race	2016-10-11 15:06:33 -07:00
math-emu
media
memory
misc
net	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2016-10-06 09:52:23 -07:00
pcmcia
ras
rdma	Merge of primary rdma-core code for 4.9	2016-10-09 17:04:33 -07:00
rxrpc	rxrpc: Add tracepoint for ACK proposal	2016-09-23 15:49:19 +01:00
scsi	Merge remote-tracking branch 'mkp-scsi/4.8/scsi-fixes' into fixes	2016-09-27 22:30:51 -07:00
soc	The core clk framework changes are small again. They're mostly minor fixes	2016-10-04 11:04:57 -07:00
sound	ASoC: Updates for v4.9	2016-09-30 18:40:40 +02:00
target
trace	mm, compaction: rename COMPACT_PARTIAL to COMPACT_SUCCESS	2016-10-07 18:46:27 -07:00
uapi	autofs4: move linux/auto_dev-ioctl.h to uapi/linux	2016-10-11 15:06:31 -07:00
video
xen	xen: features and fixes for 4.9-rc0	2016-10-06 11:19:10 -07:00
Kbuild