From patchwork Thu Jul 16 06:05:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Biggers X-Patchwork-Id: 11666743 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 325A21510 for ; Thu, 16 Jul 2020 06:07:03 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E91852071B for ; Thu, 16 Jul 2020 06:07:02 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="Z70WgQlP" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E91852071B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 4037B6B0005; Thu, 16 Jul 2020 02:07:02 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 3B44B6B0006; Thu, 16 Jul 2020 02:07:02 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2EFA56B0007; Thu, 16 Jul 2020 02:07:02 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0210.hostedemail.com [216.40.44.210]) by kanga.kvack.org (Postfix) with ESMTP id 1B0C96B0005 for ; Thu, 16 Jul 2020 02:07:02 -0400 (EDT) Received: from smtpin08.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id CFE43181AC9CB for ; Thu, 16 Jul 2020 06:07:01 +0000 (UTC) X-FDA: 77042905842.08.wood09_4c06f8b26eff Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin08.hostedemail.com (Postfix) with ESMTP id A40941819E798 for ; Thu, 16 Jul 2020 06:07:01 +0000 (UTC) X-Spam-Summary: 1,0,0,e8d031b611861117,d41d8cd98f00b204,ebiggers@kernel.org,,RULES_HIT:41:355:379:541:800:960:973:988:989:1260:1311:1314:1345:1431:1437:1515:1534:1542:1711:1730:1747:1777:1792:2393:2553:2559:2562:3138:3139:3140:3141:3142:3353:3865:3866:3867:3868:3870:3871:3872:3874:4321:5007:6261:6653:7576:10004:11026:11232:11473:11658:11914:12043:12266:12297:12438:12517:12519:12555:12660:12679:12895:13161:13229:13894:14096:14181:14394:14721:21080:21365:21451:21627:21987:21990:30054:30064:30070:30090,0,RBL:198.145.29.99:@kernel.org:.lbl8.mailshell.net-62.2.0.100 64.100.201.201;04yr3crnq7gdm43tm43i8s4frz4toopmydfpbwyjkwx4mmytn578ks4k7szdf4o.b3wk3dx11igfsgxydnymxaw5tdhkew8sau66km56mhmc7w97cygdgufwtk3ptw6.1-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:28,LUA_SUMMARY:none X-HE-Tag: wood09_4c06f8b26eff X-Filterd-Recvd-Size: 3788 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf22.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jul 2020 06:07:01 +0000 (UTC) Received: from sol.hsd1.ca.comcast.net (c-107-3-166-239.hsd1.ca.comcast.net [107.3.166.239]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DB060206F4; Thu, 16 Jul 2020 06:06:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1594879620; bh=a/Z2jsgBCNcbRZRS+qs+lrfIqcjK6kvbiG2Pc7fwMOI=; h=From:To:Cc:Subject:Date:From; b=Z70WgQlPscY4H4F+i9ex3im3FQ6W8Mc6JPHEtn0+JjRMnO9oDgTZ05k4ChRDB/HSS R5xn5ORr6e/O+PwdWFS+LdBY63MnpaFRxc9nnDNZKPUbnepRjnvjlwOrP0vkBtCKLI w/4siG6RlDUraAaUbD7C7vtcSeVFmaDBHmWLYNJo= From: Eric Biggers To: Arnd Bergmann , Greg Kroah-Hartman , linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, Dan Williams , Ingo Molnar , Kees Cook , Matthew Wilcox , Russell King , Andrew Morton Subject: [PATCH] /dev/mem: Add missing memory barriers for devmem_inode Date: Wed, 15 Jul 2020 23:05:53 -0700 Message-Id: <20200716060553.24618-1-ebiggers@kernel.org> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 X-Rspamd-Queue-Id: A40941819E798 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam01 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Eric Biggers WRITE_ONCE() isn't the correct way to publish a pointer to a data structure, since it doesn't include a write memory barrier. Therefore other tasks may see that the pointer has been set but not see that the pointed-to memory has finished being initialized yet. Instead a primitive with "release" semantics is needed. Use smp_store_release() for this. The use of READ_ONCE() on the read side is still potentially correct if there's no control dependency, i.e. if all memory being "published" is transitively reachable via the pointer itself. But this pairing is somewhat confusing and error-prone. So just upgrade the read side to smp_load_acquire() so that it clearly pairs with smp_store_release(). Cc: Dan Williams Cc: Arnd Bergmann Cc: Ingo Molnar Cc: Kees Cook Cc: Matthew Wilcox Cc: Russell King Cc: Andrew Morton Cc: Greg Kroah-Hartman Fixes: 3234ac664a87 ("/dev/mem: Revoke mappings when a driver claims the region") Signed-off-by: Eric Biggers Acked-by: Dan Williams --- drivers/char/mem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) base-commit: f8456690ba8eb18ea4714e68554e242a04f65cff diff --git a/drivers/char/mem.c b/drivers/char/mem.c index 934c92dcb9ab..687d4af6945d 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -814,7 +814,8 @@ static struct inode *devmem_inode; #ifdef CONFIG_IO_STRICT_DEVMEM void revoke_devmem(struct resource *res) { - struct inode *inode = READ_ONCE(devmem_inode); + /* pairs with smp_store_release() in devmem_init_inode() */ + struct inode *inode = smp_load_acquire(&devmem_inode); /* * Check that the initialization has completed. Losing the race @@ -1028,8 +1029,11 @@ static int devmem_init_inode(void) return rc; } - /* publish /dev/mem initialized */ - WRITE_ONCE(devmem_inode, inode); + /* + * Publish /dev/mem initialized. + * Pairs with smp_load_acquire() in revoke_devmem(). + */ + smp_store_release(&devmem_inode, inode); return 0; }