Re: [PATCH] timekeeping: Use data_race() and READ_ONCE() in ktime_get_real_seconds()

[Dennis Moshegov]

From: Dennis M <dennismoshegov@xxxxxxxxx>
Subject: [PATCH v2] timekeeping: Use READ_ONCE/WRITE_ONCE for
xtime_sec to prevent tearing

The timekeeper update path uses a bulk memcpy() to
 synchronize the timekeeper structure, which is not guaranteed to be atomic.
 This allows for torn reads in ktime_get_real_seconds() on 64-bit systems,
 where the sequence counter protection is bypassed for performance.

To prevent reading a torn 64-bit xtime_sec value, enforce atomic-like
access by using WRITE_ONCE() for the critical field before the bulk
memcpy() in timekeeping_update_from_shadow(). Correspondingly, use
READ_ONCE() in ktime_get_real_seconds() to ensure a fresh, consistent
load from memory.

Reported-by: syzbot+72789cd1697965e714ca@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspotmail.com/bug?extid=72789cd1697965e714ca
Signed-off-by: Dennis Moshegov <dennis@xxxxxxxx>
---
 timekeeping.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/timekeeping.c b/timekeeping.c
index c493a40..461a68e 100644
--- a/timekeeping.c
+++ b/timekeeping.c
@@ -826,6 +826,7 @@ static void timekeeping_update_from_shadow(struct
tk_data *tkd, unsigned int act
     * the cacheline optimized data layout of the timekeeper and requires
     * another indirection.
     */
+   WRITE_ONCE(tkd->timekeeper.xtime_secy, tk->xtime_sec);
    memcpy(&tkd->timekeeper, tk, sizeof(*tk));
    write_seqcount_end(&tkd->seq);
 }
@@ -1153,11 +1154,11 @@ time64_t ktime_get_real_seconds(void)
    unsigned int seq;

    if (IS_ENABLED(CONFIG_64BIT))
-       return tk->xtime_sec;
+       return READ_ONCE(tk->xtime_sec);

    do {
        seq = read_seqcount_begin(&tk_core.seq);
-       seconds = tk->xtime_sec;
+       seconds = READ_ONCE(tk->xtime_sec);

    } while (read_seqcount_retry(&tk_core.seq, seq));

@@ -1179,7 +1180,7 @@ noinstr time64_t __ktime_get_real_seconds(void)
 {
    struct timekeeper *tk = &tk_core.timekeeper;

-   return tk->xtime_sec;
+   return READ_ONCE(tk->xtime_sec);
 }

 /**

--
2.53.0.windows.1