lkml.org 
[lkml]   [2010]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[02/89] futex: Handle futex value corruption gracefully
    2.6.31-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Thomas Gleixner <tglx@linutronix.de>

    commit 59647b6ac3050dd964bc556fe6ef22f4db5b935c upstream.

    The WARN_ON in lookup_pi_state which complains about a mismatch
    between pi_state->owner->pid and the pid which we retrieved from the
    user space futex is completely bogus.

    The code just emits the warning and then continues despite the fact
    that it detected an inconsistent state of the futex. A conveniant way
    for user space to spam the syslog.

    Replace the WARN_ON by a consistency check. If the values do not match
    return -EINVAL and let user space deal with the mess it created.

    This also fixes the missing task_pid_vnr() when we compare the
    pi_state->owner pid with the futex value.

    Reported-by: Jermome Marchand <jmarchan@redhat.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Acked-by: Darren Hart <dvhltc@us.ibm.com>
    Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    kernel/futex.c | 21 +++++++++++++++++++--
    1 file changed, 19 insertions(+), 2 deletions(-)

    --- a/kernel/futex.c
    +++ b/kernel/futex.c
    @@ -531,8 +531,25 @@ lookup_pi_state(u32 uval, struct futex_h
    return -EINVAL;

    WARN_ON(!atomic_read(&pi_state->refcount));
    - WARN_ON(pid && pi_state->owner &&
    - pi_state->owner->pid != pid);
    +
    + /*
    + * When pi_state->owner is NULL then the owner died
    + * and another waiter is on the fly. pi_state->owner
    + * is fixed up by the task which acquires
    + * pi_state->rt_mutex.
    + *
    + * We do not check for pid == 0 which can happen when
    + * the owner died and robust_list_exit() cleared the
    + * TID.
    + */
    + if (pid && pi_state->owner) {
    + /*
    + * Bail out if user space manipulated the
    + * futex value.
    + */
    + if (pid != task_pid_vnr(pi_state->owner))
    + return -EINVAL;
    + }

    atomic_inc(&pi_state->refcount);
    *ps = pi_state;



    \
     
     \ /
      Last update: 2010-03-31 02:39    [W:4.124 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site