No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Thomas Gleixner 22d7ec50ff debugobject: Prevent init race with static objects
[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ]

Statically initialized objects are usually not initialized via the init()
function of the subsystem. They are special cased and the subsystem
provides a function to validate whether an object which is not yet tracked
by debugobjects is statically initialized. This means the object is started
to be tracked on first use, e.g. activation.

This works perfectly fine, unless there are two concurrent operations on
that object. Schspa decoded the problem:

T0 	          	    	    T1

debug_object_assert_init(addr)
  lock_hash_bucket()
  obj = lookup_object(addr);
  if (!obj) {
  	unlock_hash_bucket();
	- > preemption
			            lock_subsytem_object(addr);
				      activate_object(addr)
				      lock_hash_bucket();
				      obj = lookup_object(addr);
				      if (!obj) {
				    	unlock_hash_bucket();
					if (is_static_object(addr))
					   init_and_track(addr);
				      lock_hash_bucket();
				      obj = lookup_object(addr);
				      obj->state = ACTIVATED;
				      unlock_hash_bucket();

				    subsys function modifies content of addr,
				    so static object detection does
				    not longer work.

				    unlock_subsytem_object(addr);

        if (is_static_object(addr)) <- Fails

	  debugobject emits a warning and invokes the fixup function which
	  reinitializes the already active object in the worst case.

This race exists forever, but was never observed until mod_timer() got a
debug_object_assert_init() added which is outside of the timer base lock
held section right at the beginning of the function to cover the lockless
early exit points too.

Rework the code so that the lookup, the static object check and the
tracking object association happens atomically under the hash bucket
lock. This prevents the issue completely as all callers are serialized on
the hash bucket lock and therefore cannot observe inconsistent state.

Fixes: 3ac7fe5a4a ("infrastructure to debug (dynamic) objects")
Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com
Debugged-by: Schspa Shi <schspa@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462
Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com
Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-17 11:35:39 +02:00
arch arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-05-17 11:35:39 +02:00
block blk-iocost: fix divide by 0 error in calc_lcoefs() 2023-03-11 16:43:54 +01:00
certs
crypto asymmetric_keys: log on fatal failures in PE/pkcs7 2023-04-20 12:07:36 +02:00
Documentation media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format. 2023-05-17 11:35:36 +02:00
drivers regulator: stm32-pwr: fix of_iomap leak 2023-05-17 11:35:38 +02:00
fs erofs: fix potential overflow calculating xattr_isize 2023-05-17 11:35:35 +02:00
include media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format. 2023-05-17 11:35:36 +02:00
init init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash 2022-12-08 11:22:59 +01:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:23:06 +01:00
kernel ring-buffer: Sync IRQ works before buffer destruction 2023-05-17 11:35:33 +02:00
lib debugobject: Prevent init race with static objects 2023-05-17 11:35:39 +02:00
LICENSES
mm mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() 2023-04-20 12:07:35 +02:00
net bluetooth: Perform careful capability checks in hci_sock_ioctl() 2023-05-17 11:35:31 +02:00
samples samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() 2023-01-18 11:41:26 +01:00
scripts ASN.1: Fix check for strdup() success 2023-04-26 11:24:06 +02:00
security selinux: ensure av_permissions.h is built when needed 2023-05-17 11:35:34 +02:00
sound ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 2023-05-17 11:35:31 +02:00
tools perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) 2023-05-17 11:35:32 +02:00
usr
virt KVM: Destroy target device if coalesced MMIO unregistration fails 2023-03-11 16:44:01 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS net/phy/mdio-i2c: Move header file to include/linux/mdio 2023-02-06 07:52:46 +01:00
Makefile Linux 5.4.242 2023-04-26 11:24:06 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.