Manfred Spraul 5864a2fd30 ipc/sem.c: fix complex_count vs. simple op race
Commit 6d07b68ce16a ("ipc/sem.c: optimize sem_lock()") introduced a
race:

sem_lock has a fast path that allows parallel simple operations.
There are two reasons why a simple operation cannot run in parallel:
 - a non-simple operations is ongoing (sma->sem_perm.lock held)
 - a complex operation is sleeping (sma->complex_count != 0)

As both facts are stored independently, a thread can bypass the current
checks by sleeping in the right positions.  See below for more details
(or kernel bugzilla 105651).

The patch fixes that by creating one variable (complex_mode)
that tracks both reasons why parallel operations are not possible.

The patch also updates stale documentation regarding the locking.

With regards to stable kernels:
The patch is required for all kernels that include the
commit 6d07b68ce16a ("ipc/sem.c: optimize sem_lock()") (3.10?)

The alternative is to revert the patch that introduced the race.

The patch is safe for backporting, i.e. it makes no assumptions
about memory barriers in spin_unlock_wait().

Background:
Here is the race of the current implementation:

Thread A: (simple op)
- does the first "sma->complex_count == 0" test

Thread B: (complex op)
- does sem_lock(): This includes an array scan. But the scan can't
  find Thread A, because Thread A does not own sem->lock yet.
- the thread does the operation, increases complex_count,
  drops sem_lock, sleeps

Thread A:
- spin_lock(&sem->lock), spin_is_locked(sma->sem_perm.lock)
- sleeps before the complex_count test

Thread C: (complex op)
- does sem_lock (no array scan, complex_count==1)
- wakes up Thread B.
- decrements complex_count

Thread A:
- does the complex_count test

Bug:
Now both thread A and thread C operate on the same array, without
any synchronization.

Fixes: 6d07b68ce16a ("ipc/sem.c: optimize sem_lock()")
Link: http://lkml.kernel.org/r/1469123695-5661-1-git-send-email-manfred@colorfullife.com
Reported-by: <felixh@informatik.uni-bremen.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: <1vier1@web.de>
Cc: <stable@vger.kernel.org>	[3.10+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-10-11 15:06:33 -07:00
..
2016-05-09 16:18:37 +02:00
2016-10-07 08:35:35 -07:00
2016-10-05 11:34:53 -07:00
2016-09-10 17:31:39 +05:30
2016-10-03 23:22:47 -04:00
2016-07-08 16:23:11 +02:00
2016-08-12 12:32:24 -07:00
2016-09-14 20:37:50 +02:00
2016-10-03 20:11:49 -07:00
2016-09-14 09:18:06 -06:00
2016-06-07 13:41:38 -06:00
2016-09-29 01:35:35 -04:00
2016-08-11 09:41:35 -06:00
2016-09-27 21:20:53 -04:00
2016-08-02 19:35:24 -04:00
2016-10-07 18:46:30 -07:00
2016-05-20 21:26:15 -07:00
2016-06-07 13:41:38 -06:00
2016-05-17 15:48:12 -04:00
2016-10-07 15:15:33 -07:00
2016-09-16 12:44:20 +02:00
2016-06-27 12:26:08 -07:00
2016-07-22 09:07:02 +02:00
2016-09-24 10:48:18 +02:00
2016-03-22 15:36:02 -07:00
2016-09-14 09:18:09 -06:00
2016-09-20 23:20:32 +02:00
2016-05-11 22:37:54 +02:00
2016-03-22 15:36:02 -07:00
2016-05-20 21:26:15 -07:00
2016-03-22 15:36:02 -07:00
2016-09-15 16:49:39 +02:00
2016-09-14 12:57:43 -07:00
2016-09-27 12:33:47 +02:00
2016-08-04 10:16:55 +09:30
2016-07-29 12:17:52 -07:00
2016-07-12 19:25:38 -07:00
2016-08-28 23:32:41 -04:00
2016-06-03 19:37:21 -04:00
2016-05-17 15:47:55 -04:00
2016-04-25 15:09:11 -04:00
2016-05-02 09:00:56 -05:00
2016-07-08 18:14:03 -03:00
2016-10-07 11:46:37 -07:00
2016-07-12 19:25:38 -07:00
2016-09-27 21:52:00 -04:00
2016-09-08 15:01:10 -07:00
2016-09-08 15:01:10 -07:00
2016-03-17 15:09:34 -07:00
2016-07-06 10:51:14 +01:00
2016-09-20 04:43:36 -04:00
2016-03-22 15:36:02 -07:00
2016-07-26 16:19:19 -07:00
2016-09-08 22:15:25 -07:00
2016-06-14 10:54:40 -07:00
2016-09-06 18:30:20 +02:00
2016-08-28 23:44:55 -04:00
2016-05-08 23:46:14 -04:00
2016-10-05 18:23:36 -04:00
2016-10-07 18:46:27 -07:00
2016-09-21 00:23:00 -04:00
2016-06-20 12:47:15 -07:00
2016-07-19 17:43:38 +03:00
2016-05-20 20:57:27 -07:00
2016-05-23 17:04:14 -07:00
2016-04-07 16:53:29 -04:00
2016-07-26 16:19:19 -07:00
2016-05-20 17:58:30 -07:00
2016-06-25 09:04:48 -07:00
2016-09-30 10:54:03 +02:00
2016-08-29 08:13:21 -06:00