pps: fix race in PPS_FETCH handler [Kernel]

Prev: v4 Update the node sysfs code
Next: [linux-next] build failure

From: Vitezslav Samel on 5 Aug 2010 01:30

From: Rodolfo Giometti on 5 Aug 2010 05:20

On Thu, Aug 05, 2010 at 01:06:40AM +0400, Alexander Gordeev wrote:
> There was a race in PPS_FETCH ioctl handler when several processes want
> to obtain PPS data simultaneously using sleeping PPS_FETCH. They all
> sleep most of the time in the system call.
> With the old approach when the first process waiting on the pps queue
> is waken up it makes new system call right away and zeroes pps->go. So
> other processes continue to sleep. This is a clear race condition
> because of the global 'go' variable.
> With the new approach pps->last_ev holds some value increasing at each
> PPS event. PPS_FETCH ioctl handler saves current value to the local
> variable at the very beginning so it can safely check that there is a
> new event by just comparing both variables.
>
> Signed-off-by: Alexander Gordeev <lasaine(a)lvk.cs.msu.su>
> ---
> drivers/pps/kapi.c | 4 ++--
> drivers/pps/pps.c | 10 +++++++---
> include/linux/pps_kernel.h | 2 +-
> 3 files changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
> index 55f3961..3f89f5e 100644
> --- a/drivers/pps/kapi.c
> +++ b/drivers/pps/kapi.c
> @@ -326,8 +326,8 @@ void pps_event(int source, struct pps_ktime *ts, int event, void *data)
>
> /* Wake up if captured something */
> if (captured) {
> - pps->go = ~0;
> - wake_up_interruptible(&pps->queue);
> + pps->last_ev++;
> + wake_up_interruptible_all(&pps->queue);
>
> kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
> }
> diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
> index c76afb9..cb24147 100644
> --- a/drivers/pps/pps.c
> +++ b/drivers/pps/pps.c
> @@ -136,6 +136,7 @@ static long pps_cdev_ioctl(struct file *file,
>
> case PPS_FETCH: {
> struct pps_fdata fdata;
> + unsigned int ev;
>
> pr_debug("PPS_FETCH: source %d\n", pps->id);
>
> @@ -143,11 +144,12 @@ static long pps_cdev_ioctl(struct file *file,
> if (err)
> return -EFAULT;
>
> - pps->go = 0;
> + ev = pps->last_ev;
>
> /* Manage the timeout */
> if (fdata.timeout.flags & PPS_TIME_INVALID)
> - err = wait_event_interruptible(pps->queue, pps->go);
> + err = wait_event_interruptible(pps->queue,
> + ev < pps->last_ev);
> else {
> unsigned long ticks;
>
> @@ -159,7 +161,9 @@ static long pps_cdev_ioctl(struct file *file,
>
> if (ticks != 0) {
> err = wait_event_interruptible_timeout(
> - pps->queue, pps->go, ticks);
> + pps->queue,
> + ev < pps->last_ev,
> + ticks);
> if (err == 0)
> return -ETIMEDOUT;
> }
> diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h
> index c930d11..c3aed4b 100644
> --- a/include/linux/pps_kernel.h
> +++ b/include/linux/pps_kernel.h
> @@ -55,7 +55,7 @@ struct pps_device {
> struct pps_ktime clear_tu;
> int current_mode; /* PPS mode at event time */
>
> - int go; /* PPS event is arrived? */
> + unsigned int last_ev; /* last PPS event id */
> wait_queue_head_t queue; /* PPS event queue */
>
> unsigned int id; /* PPS source unique ID */
> --
> 1.7.1

Yes. It was added when we passed from ioctl to unlocked_ioctl...

Acked-by: Rodolfo Giometti <giometti(a)linux.it>

--

GNU/Linux Solutions e-mail: giometti(a)enneenne.com
Linux Device Driver giometti(a)linux.it
Embedded Systems phone: +39 349 2432127
UNIX programming skype: rodolfo.giometti
Freelance ICT Italia - Consulente ICT Italia - www.consulenti-ict.it
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Alexander Gordeev on 5 Aug 2010 06:30

Hi Vitezslav,

Ð Thu, 5 Aug 2010 07:19:29 +0200
Vitezslav Samel <vitezslav(a)samel.cz> Ð¿Ð¸ÑÐµÑ:

> On Thu, Aug 05, 2010 at 01:06:40AM +0400, Alexander Gordeev wrote:
> > There was a race in PPS_FETCH ioctl handler when several processes want
> > to obtain PPS data simultaneously using sleeping PPS_FETCH. They all
> > sleep most of the time in the system call.
> > With the old approach when the first process waiting on the pps queue
> > is waken up it makes new system call right away and zeroes pps->go. So
> > other processes continue to sleep. This is a clear race condition
> > because of the global 'go' variable.
> > With the new approach pps->last_ev holds some value increasing at each
> > PPS event. PPS_FETCH ioctl handler saves current value to the local
> > variable at the very beginning so it can safely check that there is a
> > new event by just comparing both variables.
> >
> > Signed-off-by: Alexander Gordeev <lasaine(a)lvk.cs.msu.su>
> > ---
> > drivers/pps/kapi.c | 4 ++--
> > drivers/pps/pps.c | 10 +++++++---
> > include/linux/pps_kernel.h | 2 +-
> > 3 files changed, 10 insertions(+), 6 deletions(-)
> >
> > diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
> > index 55f3961..3f89f5e 100644
> > --- a/drivers/pps/kapi.c
> > +++ b/drivers/pps/kapi.c
> > @@ -326,8 +326,8 @@ void pps_event(int source, struct pps_ktime *ts, int event, void *data)
> >
> > /* Wake up if captured something */
> > if (captured) {
> > - pps->go = ~0;
> > - wake_up_interruptible(&pps->queue);
> > + pps->last_ev++;
> > + wake_up_interruptible_all(&pps->queue);
>
> What happens if pps->last_ev overflows? Seems to me it would freeze
> pps.

Yes, it will freeze the fds (if they don't use timeouts). But in normal
circumstances, i.e. when pps_event is called twice a second, it will
overflow after ~68 years of uninterrupted work. Well, it's the same
kind of problem as an overflow of struct timespec. I thought it's not
actually a problem. Should I use u64 instead of unsigned int or add a
runtime check somewhere?

--
Alexander

From: Vitezslav Samel on 5 Aug 2010 07:10

On Thu, Aug 05, 2010 at 02:19:51PM +0400, Alexander Gordeev wrote:
> Hi Vitezslav,
>
> В Thu, 5 Aug 2010 07:19:29 +0200
> Vitezslav Samel <vitezslav(a)samel.cz> пишет:
>
> > On Thu, Aug 05, 2010 at 01:06:40AM +0400, Alexander Gordeev wrote:
> > > There was a race in PPS_FETCH ioctl handler when several processes want
> > > to obtain PPS data simultaneously using sleeping PPS_FETCH. They all
> > > sleep most of the time in the system call.
> > > With the old approach when the first process waiting on the pps queue
> > > is waken up it makes new system call right away and zeroes pps->go. So
> > > other processes continue to sleep. This is a clear race condition
> > > because of the global 'go' variable.
> > > With the new approach pps->last_ev holds some value increasing at each
> > > PPS event. PPS_FETCH ioctl handler saves current value to the local
> > > variable at the very beginning so it can safely check that there is a
> > > new event by just comparing both variables.
> > >
> > > Signed-off-by: Alexander Gordeev <lasaine(a)lvk.cs.msu.su>
> > > ---
> > > drivers/pps/kapi.c | 4 ++--
> > > drivers/pps/pps.c | 10 +++++++---
> > > include/linux/pps_kernel.h | 2 +-
> > > 3 files changed, 10 insertions(+), 6 deletions(-)
> > >
> > > diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
> > > index 55f3961..3f89f5e 100644
> > > --- a/drivers/pps/kapi.c
> > > +++ b/drivers/pps/kapi.c
> > > @@ -326,8 +326,8 @@ void pps_event(int source, struct pps_ktime *ts, int event, void *data)
> > >
> > > /* Wake up if captured something */
> > > if (captured) {
> > > - pps->go = ~0;
> > > - wake_up_interruptible(&pps->queue);
> > > + pps->last_ev++;
> > > + wake_up_interruptible_all(&pps->queue);
> >
> > What happens if pps->last_ev overflows? Seems to me it would freeze
> > pps.
>
> Yes, it will freeze the fds (if they don't use timeouts). But in normal
> circumstances, i.e. when pps_event is called twice a second, it will
> overflow after ~68 years of uninterrupted work. Well, it's the same
> kind of problem as an overflow of struct timespec. I thought it's not
> actually a problem. Should I use u64 instead of unsigned int or add a
> runtime check somewhere?

If we're using 1PPS it's ~68 years, but someone is trying 5PPS now
(it would overflow in ~13.6 years) - what if someone tries e.g. 100PPS?
It's not the same as overflow of struct timespec! I think it deserves
some treatment.

Cheers,
Vita
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Alexander Gordeev on 5 Aug 2010 10:40

Ð Thu, 5 Aug 2010 13:07:50 +0200
Vitezslav Samel <vitezslav(a)samel.cz> Ð¿Ð¸ÑÐµÑ:

> On Thu, Aug 05, 2010 at 02:19:51PM +0400, Alexander Gordeev wrote:
> > Hi Vitezslav,
> >
> > Ð Thu, 5 Aug 2010 07:19:29 +0200
> > Vitezslav Samel <vitezslav(a)samel.cz> Ð¿Ð¸ÑÐµÑ:
> >
> > > On Thu, Aug 05, 2010 at 01:06:40AM +0400, Alexander Gordeev wrote:
> > > > There was a race in PPS_FETCH ioctl handler when several processes want
> > > > to obtain PPS data simultaneously using sleeping PPS_FETCH. They all
> > > > sleep most of the time in the system call.
> > > > With the old approach when the first process waiting on the pps queue
> > > > is waken up it makes new system call right away and zeroes pps->go. So
> > > > other processes continue to sleep. This is a clear race condition
> > > > because of the global 'go' variable.
> > > > With the new approach pps->last_ev holds some value increasing at each
> > > > PPS event. PPS_FETCH ioctl handler saves current value to the local
> > > > variable at the very beginning so it can safely check that there is a
> > > > new event by just comparing both variables.
> > > >
> > > > Signed-off-by: Alexander Gordeev <lasaine(a)lvk.cs.msu.su>
> > > > ---
> > > > drivers/pps/kapi.c | 4 ++--
> > > > drivers/pps/pps.c | 10 +++++++---
> > > > include/linux/pps_kernel.h | 2 +-
> > > > 3 files changed, 10 insertions(+), 6 deletions(-)
> > > >
> > > > diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
> > > > index 55f3961..3f89f5e 100644
> > > > --- a/drivers/pps/kapi.c
> > > > +++ b/drivers/pps/kapi.c
> > > > @@ -326,8 +326,8 @@ void pps_event(int source, struct pps_ktime *ts, int event, void *data)
> > > >
> > > > /* Wake up if captured something */
> > > > if (captured) {
> > > > - pps->go = ~0;
> > > > - wake_up_interruptible(&pps->queue);
> > > > + pps->last_ev++;
> > > > + wake_up_interruptible_all(&pps->queue);
> > >
> > > What happens if pps->last_ev overflows? Seems to me it would freeze
> > > pps.
> >
> > Yes, it will freeze the fds (if they don't use timeouts). But in normal
> > circumstances, i.e. when pps_event is called twice a second, it will
> > overflow after ~68 years of uninterrupted work. Well, it's the same
> > kind of problem as an overflow of struct timespec. I thought it's not
> > actually a problem. Should I use u64 instead of unsigned int or add a
> > runtime check somewhere?
>
> If we're using 1PPS it's ~68 years, but someone is trying 5PPS now
> (it would overflow in ~13.6 years) - what if someone tries e.g. 100PPS?
> It's not the same as overflow of struct timespec! I think it deserves
> some treatment.

You are right. :)
I'll use u64 here then which should be enough for sure, ok?

Thanks for the note!

--
Alexander

|
Pages: 1
Prev: v4 Update the node sysfs code
Next: [linux-next] build failure