lkml.org 
[lkml]   [2014]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.8 61/65] futex: Validate atomic acquisition in futex_lock_pi_atomic()
    Date
    3.8.13.25 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Thomas Gleixner <tglx@linutronix.de>

    commit b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 upstream.

    We need to protect the atomic acquisition in the kernel against rogue
    user space which sets the user space futex to 0, so the kernel side
    acquisition succeeds while there is existing state in the kernel
    associated to the real owner.

    Verify whether the futex has waiters associated with kernel state. If
    it has, return -EINVAL. The state is corrupted already, so no point in
    cleaning it up. Subsequent calls will fail as well. Not our problem.

    [ tglx: Use futex_top_waiter() and explain why we do not need to try
    restoring the already corrupted user space state. ]

    Signed-off-by: Darren Hart <dvhart@linux.intel.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Will Drewry <wad@chromium.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    kernel/futex.c | 14 +++++++++++---
    1 file changed, 11 insertions(+), 3 deletions(-)

    diff --git a/kernel/futex.c b/kernel/futex.c
    index c845054..10e53ad 100644
    --- a/kernel/futex.c
    +++ b/kernel/futex.c
    @@ -758,10 +758,18 @@ retry:
    return -EDEADLK;

    /*
    - * Surprise - we got the lock. Just return to userspace:
    + * Surprise - we got the lock, but we do not trust user space at all.
    */
    - if (unlikely(!curval))
    - return 1;
    + if (unlikely(!curval)) {
    + /*
    + * We verify whether there is kernel state for this
    + * futex. If not, we can safely assume, that the 0 ->
    + * TID transition is correct. If state exists, we do
    + * not bother to fixup the user space state as it was
    + * corrupted already.
    + */
    + return futex_top_waiter(hb, key) ? -EINVAL : 1;
    + }

    uval = curval;

    --
    1.9.1


    \
     
     \ /
      Last update: 2014-06-24 23:21    [W:4.530 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site