Date: Fri, 24 Mar 2017 21:22:42 +0100
From: Peter Zijlstra <peterz@infradead.org>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Dmitry Vyukov <dvyukov@google.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@alien8.de>,
        Brian Gerst <brgerst@gmail.com>, Denys Vlasenko <dvlasenk@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>, Josh Poimboeuf <jpoimboe@redhat.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Paul McKenney <paulmck@linux.vnet.ibm.com>,
        Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Subject: Re: locking/atomic: Introduce atomic_try_cmpxchg()
Message-ID: <20170324202242.GA5680@worktop>
References: <CACT4Y+bG+a0w6j6v1AmBE7fqqMSPyPEm4QimCzCouicmHT8FqA@mail.gmail.com>
 <20170324142140.vpyzl755oj6rb5qv@hirez.programming.kicks-ass.net>
 <20170324164108.ibcxxqbhvx6ao54r@hirez.programming.kicks-ass.net>
 <CALCETrVFOKC91hKWxm+-w2v2FPGJ37RoCOYX5FYpszjMrAaUOQ@mail.gmail.com>
 <20170324172342.radlrhk2z6mwmdgk@hirez.programming.kicks-ass.net>
 <CALCETrXqLWkJhoUnD+ERrYabvZu1=DbQ1CidYpAn1Ewwrg1FcA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CALCETrXqLWkJhoUnD+ERrYabvZu1=DbQ1CidYpAn1Ewwrg1FcA@mail.gmail.com>
User-Agent: Mutt/1.5.22.1 (2013-10-16)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 664
Lines: 19

On Fri, Mar 24, 2017 at 11:45:46AM -0700, Andy Lutomirski wrote:
> After playing with it a bit, I found some of the problem: you're
> passing val into EXCEPTION_VALUE, which keeps it live.  If I get rid
> of that, the generated code is great.

Right, so I needed that because I land on ud2 through 2 different paths:

 - newly saturated
 - use-after-free

And the exception handler can figure out which of the two by looking at
the variable, but then of course, it needs to be life.

For the full horror of how to do this, look here:

  http://paste.debian.net/924190/

But I didn't just show you that, so you can't blame me for any damage
that might've done you.