Transfer findings from ipc/sem.c:
- A control barrier was missing for the lockless receive case
  So in theory, not yet initialized data may have been copied
  to user space - obviously only for architectures where
  control barriers are not NOP.

- Add documentation. Especially, document that the code relies
  on the barrier inside wake_q_add().

Signed-off-by: Manfred Spraul <manf...@colorfullife.com>
Cc: Waiman Long <long...@redhat.com>
Cc: Davidlohr Bueso <d...@stgolabs.net>
---
 ipc/msg.c | 39 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/ipc/msg.c b/ipc/msg.c
index 8dec945fa030..1e2c0a3d4998 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -184,6 +184,10 @@ static inline void ss_add(struct msg_queue *msq,
 {
        mss->tsk = current;
        mss->msgsz = msgsz;
+       /*
+        * No memory barrier required: we did ipc_lock_object(),
+        * and the waker obtains that lock before calling wake_q_add().
+        */
        __set_current_state(TASK_INTERRUPTIBLE);
        list_add_tail(&mss->list, &msq->q_senders);
 }
@@ -238,6 +242,12 @@ static void expunge_all(struct msg_queue *msq, int res,
 
        list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
                wake_q_add(wake_q, msr->r_tsk);
+
+               /*
+                * A memory barrier is required that pairs with the
+                * READ_ONCE()+smp_mb__after_ctrl_dep(). It is provided by
+                * wake_q_add().
+                */
                WRITE_ONCE(msr->r_msg, ERR_PTR(res));
        }
 }
@@ -798,12 +808,24 @@ static inline int pipelined_send(struct msg_queue *msq, 
struct msg_msg *msg,
                        list_del(&msr->r_list);
                        if (msr->r_maxsize < msg->m_ts) {
                                wake_q_add(wake_q, msr->r_tsk);
+
+                               /*
+                                * A memory barrier is required that pairs with
+                                * the READ_ONCE()+smp_mb__after_ctrl_dep().
+                                * It is provided by wake_q_add().
+                                */
                                WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG));
                        } else {
                                ipc_update_pid(&msq->q_lrpid, 
task_pid(msr->r_tsk));
                                msq->q_rtime = ktime_get_real_seconds();
 
                                wake_q_add(wake_q, msr->r_tsk);
+
+                               /*
+                                * A memory barrier is required that pairs with
+                                * the READ_ONCE()+smp_mb__after_ctrl_dep().
+                                * It is provided by wake_q_add().
+                                */
                                WRITE_ONCE(msr->r_msg, msg);
                                return 1;
                        }
@@ -1155,6 +1177,8 @@ static long do_msgrcv(int msqid, void __user *buf, size_t 
bufsz, long msgtyp, in
                else
                        msr_d.r_maxsize = bufsz;
                msr_d.r_msg = ERR_PTR(-EAGAIN);
+
+               /* memory barrier not required, we own ipc_lock_object() */
                __set_current_state(TASK_INTERRUPTIBLE);
 
                ipc_unlock_object(&msq->q_perm);
@@ -1183,8 +1207,21 @@ static long do_msgrcv(int msqid, void __user *buf, 
size_t bufsz, long msgtyp, in
                 * signal) it will either see the message and continue ...
                 */
                msg = READ_ONCE(msr_d.r_msg);
-               if (msg != ERR_PTR(-EAGAIN))
+               if (msg != ERR_PTR(-EAGAIN)) {
+                       /*
+                        * Memory barrier for msr_d.r_msg
+                        * The smp_acquire__after_ctrl_dep(), together with the
+                        * READ_ONCE() above pairs with the barrier inside
+                        * wake_q_add().
+                        * The barrier protects the accesses to the message in
+                        * do_msg_fill(). In addition, the barrier protects user
+                        * space, too: User space may assume that all data from
+                        * the CPU that sent the message is visible.
+                        */
+                       smp_acquire__after_ctrl_dep();
+
                        goto out_unlock1;
+               }
 
                 /*
                  * ... or see -EAGAIN, acquire the lock to check the message
-- 
2.21.0

Reply via email to