lkml.org 
[lkml]   [2012]   [Jul]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: potential NULL dereference in futex_wait_requeue_pi()
    On 07/18/2012 07:25 AM, Dan Carpenter wrote:
    > Hi Darren,
    >
    > The patch 52400ba94675: "futex: add requeue_pi functionality" from
    > Apr 3, 2009, leads to the following warning:
    > kernel/futex.c:2373 futex_wait_requeue_pi()
    > error: potential NULL dereference 'pi_mutex'.
    >
    > 2330 if (!q.rt_waiter) {
    > 2331 /*
    > 2332 * Got the lock. We might not be the anticipated owner if we
    > 2333 * did a lock-steal - fix up the PI-state in that case.
    > 2334 */
    > 2335 if (q.pi_state && (q.pi_state->owner != current)) {
    > 2336 spin_lock(q.lock_ptr);
    > 2337 ret = fixup_pi_state_owner(uaddr2, &q, current);
    >
    > pi_mutex is NULL here and it looks like fixup_pi_state_owner() can
    > return -EFAULT.
    >
    >
    > 2338 spin_unlock(q.lock_ptr);
    > 2339 }
    > 2340 } else {
    >
    > [snipped]
    >
    > 2366 }
    > 2367
    > 2368 /*
    > 2369 * If fixup_pi_state_owner() faulted and was unable to handle the
    > 2370 * fault, unlock the rt_mutex and return the fault to userspace.
    > 2371 */
    > 2372 if (ret == -EFAULT) {
    > 2373 if (rt_mutex_owner(pi_mutex) == current)
    > ^^^^^^^^
    > This will oops if pi_mutex is NULL.
    >
    > 2374 rt_mutex_unlock(pi_mutex);
    > 2375 } else if (ret == -EINTR) {

    Nice Dan, thanks for taking a closer look. This appears to be a simple fix, can
    you try the following:


    futex: Test for pi_mutex on fault in futex_wait_requeue_pi

    If fixup_pi_state_owner() faults, pi_mutex may be NULL. Test
    for pi_mutex != NULL before testing the owner against current
    and possibly unlocking it.

    Signed-off-by: Darren Hart <dvhart@linux.intel.com>
    CC: Dave Jones <davej@redhat.com>
    CC: Dan Carpenter <dan.carpenter@oracle.com>
    CC: Thomas Gleixner <tglx@linutronix.de>

    diff --git a/kernel/futex.c b/kernel/futex.c
    index e2b0fb9..05018bf 100644
    --- a/kernel/futex.c
    +++ b/kernel/futex.c
    @@ -2370,7 +2370,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
    * fault, unlock the rt_mutex and return the fault to userspace.
    */
    if (ret == -EFAULT) {
    - if (rt_mutex_owner(pi_mutex) == current)
    + if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
    rt_mutex_unlock(pi_mutex);
    } else if (ret == -EINTR) {
    /*

    --
    Darren Hart
    Intel Open Source Technology Center
    Yocto Project - Linux Kernel




    \
     
     \ /
      Last update: 2012-07-18 18:41    [W:0.028 / U:93.472 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site