lkml.org 
[lkml]   [2017]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 22/95] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
    3.2.91-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Peter Zijlstra <peterz@infradead.org>

    commit c236c8e95a3d395b0494e7108f0d41cf36ec107c upstream.

    While working on the futex code, I stumbled over this potential
    use-after-free scenario. Dmitry triggered it later with syzkaller.

    pi_mutex is a pointer into pi_state, which we drop the reference on in
    unqueue_me_pi(). So any access to that pointer after that is bad.

    Since other sites already do rt_mutex_unlock() with hb->lock held, see
    for example futex_lock_pi(), simply move the unlock before
    unqueue_me_pi().

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Reviewed-by: Darren Hart <dvhart@linux.intel.com>
    Cc: juri.lelli@arm.com
    Cc: bigeasy@linutronix.de
    Cc: xlpang@redhat.com
    Cc: rostedt@goodmis.org
    Cc: mathieu.desnoyers@efficios.com
    Cc: jdesfossez@efficios.com
    Cc: dvhart@infradead.org
    Cc: bristot@redhat.com
    Link: http://lkml.kernel.org/r/20170304093558.801744246@infradead.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    kernel/futex.c | 20 +++++++++++---------
    1 file changed, 11 insertions(+), 9 deletions(-)

    --- a/kernel/futex.c
    +++ b/kernel/futex.c
    @@ -2410,7 +2410,6 @@ static int futex_wait_requeue_pi(u32 __u
    {
    struct hrtimer_sleeper timeout, *to = NULL;
    struct rt_mutex_waiter rt_waiter;
    - struct rt_mutex *pi_mutex = NULL;
    struct futex_hash_bucket *hb;
    union futex_key key2 = FUTEX_KEY_INIT;
    struct futex_q q = futex_q_init;
    @@ -2500,6 +2499,8 @@ static int futex_wait_requeue_pi(u32 __u
    spin_unlock(q.lock_ptr);
    }
    } else {
    + struct rt_mutex *pi_mutex;
    +
    /*
    * We have been woken up by futex_unlock_pi(), a timeout, or a
    * signal. futex_unlock_pi() will not destroy the lock_ptr nor
    @@ -2523,18 +2524,19 @@ static int futex_wait_requeue_pi(u32 __u
    if (res)
    ret = (res < 0) ? res : 0;

    + /*
    + * If fixup_pi_state_owner() faulted and was unable to handle
    + * the fault, unlock the rt_mutex and return the fault to
    + * userspace.
    + */
    + if (ret && rt_mutex_owner(pi_mutex) == current)
    + rt_mutex_unlock(pi_mutex);
    +
    /* Unqueue and drop the lock. */
    unqueue_me_pi(&q);
    }

    - /*
    - * If fixup_pi_state_owner() faulted and was unable to handle the
    - * fault, unlock the rt_mutex and return the fault to userspace.
    - */
    - if (ret == -EFAULT) {
    - if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
    - rt_mutex_unlock(pi_mutex);
    - } else if (ret == -EINTR) {
    + if (ret == -EINTR) {
    /*
    * We've already been requeued, but cannot restart by calling
    * futex_lock_pi() directly. We could restart this syscall, but
    \
     
     \ /
      Last update: 2017-07-16 16:13    [W:4.145 / U:0.812 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site