[PATCH] acpi: fix potential race conditions bypassing checks

[PATCH] acpi: fix potential race conditions bypassing checks

[Kangjie Lu]

"obj" is a local variable. Elements are deep-copied from external
package to obj and security-checked. The original code is
seemingly fine; however, compilers optimize the deep copies into
shallow copies, introducing potential race conditions. For
example, the checks for type and length may be bypassed. The fix
tells compilers to not optimize the deep copy by inserting
"volatile".

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
---
 drivers/acpi/processor_throttling.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 532a1ae3595a..6f4d86f8a9ce 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -413,7 +413,7 @@ static int acpi_processor_get_throttling_control(struct acpi_processor *pr)
 	acpi_status status = 0;
 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
 	union acpi_object *ptc = NULL;
-	union acpi_object obj = { 0 };
+	volatile union acpi_object obj = { 0 };
 	struct acpi_processor_throttling *throttling;
 
 	status = acpi_evaluate_object(pr->handle, "_PTC", NULL, &buffer);
-- 
2.17.1

Re: [PATCH] acpi: fix potential race conditions bypassing checks

[Rafael J. Wysocki]

On Monday, October 28, 2019 7:31:14 PM CET Kangjie Lu wrote:
> "obj" is a local variable. Elements are deep-copied from external
> package to obj and security-checked. The original code is
> seemingly fine; however, compilers optimize the deep copies into
> shallow copies, introducing potential race conditions. For
> example, the checks for type and length may be bypassed.

How exactly?

What compiler(s) do such optimizations in this particular case?

> The fix tells compilers to not optimize the deep copy by inserting
> "volatile".

Have you actually analyzed the object code produced by the compiler with and
without the volatile to determine whether or not it has an effect as expected
on code generation?

> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> ---
>  drivers/acpi/processor_throttling.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
> index 532a1ae3595a..6f4d86f8a9ce 100644
> --- a/drivers/acpi/processor_throttling.c
> +++ b/drivers/acpi/processor_throttling.c
> @@ -413,7 +413,7 @@ static int acpi_processor_get_throttling_control(struct acpi_processor *pr)
>  	acpi_status status = 0;
>  	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
>  	union acpi_object *ptc = NULL;
> -	union acpi_object obj = { 0 };
> +	volatile union acpi_object obj = { 0 };
>  	struct acpi_processor_throttling *throttling;
>  
>  	status = acpi_evaluate_object(pr->handle, "_PTC", NULL, &buffer);
> 

Re: [PATCH] acpi: fix potential race conditions bypassing checks

[Kangjie Lu]

> On Oct 28, 2019, at 4:51 PM, Rafael J. Wysocki <rjw@rjwysocki.net> wrote:
> 
> On Monday, October 28, 2019 7:31:14 PM CET Kangjie Lu wrote:
>> "obj" is a local variable. Elements are deep-copied from external
>> package to obj and security-checked. The original code is
>> seemingly fine; however, compilers optimize the deep copies into
>> shallow copies, introducing potential race conditions. For
>> example, the checks for type and length may be bypassed.
> 
> How exactly?
> 
> What compiler(s) do such optimizations in this particular case?

Tested on LLVM. The deep copy is indeed optimized into a shallow copy at optimization level O2.


> 
>> The fix tells compilers to not optimize the deep copy by inserting
>> "volatile".
> 
> Have you actually analyzed the object code produced by the compiler with and
> without the volatile to determine whether or not it has an effect as expected
> on code generation?

Yes, with “volatile", the deep copy is preserved, and “obj” is created as a local variable.

> 
>> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
>> ---
>> drivers/acpi/processor_throttling.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
>> index 532a1ae3595a..6f4d86f8a9ce 100644
>> --- a/drivers/acpi/processor_throttling.c
>> +++ b/drivers/acpi/processor_throttling.c
>> @@ -413,7 +413,7 @@ static int acpi_processor_get_throttling_control(struct acpi_processor *pr)
>> 	acpi_status status = 0;
>> 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
>> 	union acpi_object *ptc = NULL;
>> -	union acpi_object obj = { 0 };
>> +	volatile union acpi_object obj = { 0 };
>> 	struct acpi_processor_throttling *throttling;
>> 
>> 	status = acpi_evaluate_object(pr->handle, "_PTC", NULL, &buffer);
>> 
> 
> 
> 
> 

Re: [PATCH] acpi: fix potential race conditions bypassing checks

[Rafael J. Wysocki]

On Monday, October 28, 2019 10:32:26 PM CET Kangjie Lu wrote:
> 
> > On Oct 28, 2019, at 4:51 PM, Rafael J. Wysocki <rjw@rjwysocki.net> wrote:
> > 
> > On Monday, October 28, 2019 7:31:14 PM CET Kangjie Lu wrote:
> >> "obj" is a local variable. Elements are deep-copied from external
> >> package to obj and security-checked. The original code is
> >> seemingly fine; however, compilers optimize the deep copies into
> >> shallow copies, introducing potential race conditions. For
> >> example, the checks for type and length may be bypassed.
> > 
> > How exactly?

Not answered.

> > What compiler(s) do such optimizations in this particular case?
> 
> Tested on LLVM. The deep copy is indeed optimized into a shallow copy at optimization level O2.

OK, that should have been mentioned in the changelog.

> > 
> >> The fix tells compilers to not optimize the deep copy by inserting
> >> "volatile".
> > 
> > Have you actually analyzed the object code produced by the compiler with and
> > without the volatile to determine whether or not it has an effect as expected
> > on code generation?
> 
> Yes, with “volatile", the deep copy is preserved, and “obj” is created as a local variable.

OK, but does it actually make a practical difference?

> > 
> >> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> >> ---
> >> drivers/acpi/processor_throttling.c | 2 +-
> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >> 
> >> diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
> >> index 532a1ae3595a..6f4d86f8a9ce 100644
> >> --- a/drivers/acpi/processor_throttling.c
> >> +++ b/drivers/acpi/processor_throttling.c
> >> @@ -413,7 +413,7 @@ static int acpi_processor_get_throttling_control(struct acpi_processor *pr)
> >> 	acpi_status status = 0;
> >> 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
> >> 	union acpi_object *ptc = NULL;
> >> -	union acpi_object obj = { 0 };
> >> +	volatile union acpi_object obj = { 0 };

Why don't you change obj to a pointer instead?

> >> 	struct acpi_processor_throttling *throttling;
> >> 
> >> 	status = acpi_evaluate_object(pr->handle, "_PTC", NULL, &buffer);
> >>