[PATCH 0/1] powerpc/vdso: remove redundant locking in update_vsyscall_tz()

[Shan Hai]

On Fri, Nov 09, 2012 at 09:57:49AM +0800, Shan Hai wrote:
> The locking in update_vsyscall_tz() is not only unnecessary because the vdso
> code copies the data unproteced in __kernel_gettimeofday() but also
> introduces a hard to reproduce race condition between update_vsyscall()
> and update_vsyscall_tz(), which causes user space process to loop
> forever in vdso code.
> 
> The following patch removes the locking from update_vsyscall_tz().
> 
> ---
>  arch/powerpc/kernel/time.c |    5 -----
>  1 file changed, 5 deletions(-)
>

Hi Ben,

Would you please review this one?
 
>From 167eac293b07e0ee201ffe5043ec442d52495a48 Mon Sep 17 00:00:00 2001
From: Shan Hai <shan.hai at windriver.com>
Date: Mon, 5 Nov 2012 18:24:22 +0800
Subject: [PATCH 1/1] powerpc/vdso: remove redundant locking in
 update_vsyscall_tz()

Locking is not only unnecessary because the vdso code copies the data
unprotected in __kernel_gettimeofday() but also erroneous because updating
the tb_update_count is not atomic and introduces a hard to reproduce race
condition between update_vsyscall() and update_vsyscall_tz(), which further
causes user space process to loop forever in vdso code.

The below scenario describes the race condition,
x==0	Boot CPU			other CPU
	proc_P: x==0
	    timer interrupt
		update_vsyscall
x==1		    x++;sync		settimeofday
					    update_vsyscall_tz
x==2						x++;sync
x==3		    sync;x++
						sync;x++
	proc_P: x==3 (loops until x becomes even)

Because the ++ operator would be implemented as three instructions and not
atomic on powerpc.

A similar change was made for x86 in commit 6c260d58634
("x86: vdso: Remove bogus locking in update_vsyscall_tz")

Signed-off-by: Shan Hai <shan.hai at windriver.com>
---
 arch/powerpc/kernel/time.c |    5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 03b29a6..426141f 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -859,13 +859,8 @@ void update_vsyscall(struct timespec *wall_time, struct timespec *wtm,
 
 void update_vsyscall_tz(void)
 {
-	/* Make userspace gettimeofday spin until we're done. */
-	++vdso_data->tb_update_count;
-	smp_mb();
 	vdso_data->tz_minuteswest = sys_tz.tz_minuteswest;
 	vdso_data->tz_dsttime = sys_tz.tz_dsttime;
-	smp_mb();
-	++vdso_data->tb_update_count;
 }
 
 static void __init clocksource_init(void)
-- 
1.7.10.4

Best Regards
Shan Hai

> Thanks
> Shan Hai

> From 167eac293b07e0ee201ffe5043ec442d52495a48 Mon Sep 17 00:00:00 2001
> From: Shan Hai <shan.hai at windriver.com>
> Date: Mon, 5 Nov 2012 18:24:22 +0800
> Subject: [PATCH 1/1] powerpc/vdso: remove redundant locking in
>  update_vsyscall_tz()
> 
> Locking is not only unnecessary because the vdso code copies the data
> unprotected in __kernel_gettimeofday() but also erroneous because updating
> the tb_update_count is not atomic and introduces a hard to reproduce race
> condition between update_vsyscall() and update_vsyscall_tz(), which further
> causes user space process to loop forever in vdso code.
> 
> The below scenario describes the race condition,
> x==0	Boot CPU			other CPU
> 	proc_P: x==0
> 	    timer interrupt
> 		update_vsyscall
> x==1		    x++;sync		settimeofday
> 					    update_vsyscall_tz
> x==2						x++;sync
> x==3		    sync;x++
> 						sync;x++
> 	proc_P: x==3 (loops until x becomes even)
> 
> Because the ++ operator would be implemented as three instructions and not
> atomic on powerpc.
> 
> A similar change was made for x86 in commit 6c260d58634
> ("x86: vdso: Remove bogus locking in update_vsyscall_tz")
> 
> Signed-off-by: Shan Hai <shan.hai at windriver.com>
> ---
>  arch/powerpc/kernel/time.c |    5 -----
>  1 file changed, 5 deletions(-)
> 
> diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
> index 03b29a6..426141f 100644
> --- a/arch/powerpc/kernel/time.c
> +++ b/arch/powerpc/kernel/time.c
> @@ -859,13 +859,8 @@ void update_vsyscall(struct timespec *wall_time, struct timespec *wtm,
>  
>  void update_vsyscall_tz(void)
>  {
> -	/* Make userspace gettimeofday spin until we're done. */
> -	++vdso_data->tb_update_count;
> -	smp_mb();
>  	vdso_data->tz_minuteswest = sys_tz.tz_minuteswest;
>  	vdso_data->tz_dsttime = sys_tz.tz_dsttime;
> -	smp_mb();
> -	++vdso_data->tb_update_count;
>  }
>  
>  static void __init clocksource_init(void)
> -- 
> 1.7.10.4
> 

> _______________________________________________
> Linuxppc-dev mailing list
> Linuxppc-dev at lists.ozlabs.org
> https://lists.ozlabs.org/listinfo/linuxppc-dev