forked from rrcarlosr/Jetpack
104 lines
3.1 KiB
Diff
104 lines
3.1 KiB
Diff
From 542516c23127a3aed163eccc21aafa92e0be87f9 Mon Sep 17 00:00:00 2001
|
|
From: abhijit <abhijit@nvidia.com>
|
|
Date: Tue, 24 Apr 2018 11:35:30 +0530
|
|
Subject: [PATCH 352/352] futex: fix crash in exit pi path.
|
|
|
|
This patch is taken from below upstream commit 153fbd1226fb.
|
|
|
|
futex: Fix more put_pi_state() vs. exit_pi_state_list() races
|
|
|
|
Dmitry (through syzbot) reported being able to trigger the WARN in
|
|
get_pi_state() and a use-after-free on:
|
|
|
|
raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
|
|
|
|
Both are due to this race:
|
|
|
|
exit_pi_state_list() put_pi_state()
|
|
|
|
lock(&curr->pi_lock)
|
|
while() {
|
|
pi_state = list_first_entry(head);
|
|
hb = hash_futex(&pi_state->key);
|
|
unlock(&curr->pi_lock);
|
|
|
|
dec_and_test(&pi_state->refcount);
|
|
|
|
lock(&hb->lock)
|
|
lock(&pi_state->pi_mutex.wait_lock) // uaf if pi_state free'd
|
|
lock(&curr->pi_lock);
|
|
|
|
....
|
|
|
|
unlock(&curr->pi_lock);
|
|
get_pi_state(); // WARN; refcount==0
|
|
|
|
The problem is we take the reference count too late, and don't allow it
|
|
being 0. Fix it by using inc_not_zero() and simply retrying the loop
|
|
when we fail to get a refcount. In that case put_pi_state() should
|
|
remove the entry from the list.
|
|
|
|
Reported-by: Dmitry Vyukov <dvyukov@google.com>
|
|
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
|
|
Cc: Gratian Crisan <gratian.crisan@ni.com>
|
|
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Cc: Peter Zijlstra <peterz@infradead.org>
|
|
Cc: Thomas Gleixner <tglx@linutronix.de>
|
|
Cc: dvhart@infradead.org
|
|
Cc: syzbot <bot+2af19c9e1ffe4d4ee1d16c56ae7580feaee75765@syzkaller.appspotmail.com>
|
|
Cc: syzkaller-bugs@googlegroups.com
|
|
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
Signed-off-by: Abhijit <abhijit@nvidia.com>
|
|
---
|
|
kernel/futex.c | 20 +++++++++++++++++++-
|
|
1 file changed, 19 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/kernel/futex.c b/kernel/futex.c
|
|
index 12d03af..cbf2167 100644
|
|
--- a/kernel/futex.c
|
|
+++ b/kernel/futex.c
|
|
@@ -900,6 +900,24 @@ void exit_pi_state_list(struct task_struct *curr)
|
|
pi_state = list_entry(next, struct futex_pi_state, list);
|
|
key = pi_state->key;
|
|
hb = hash_futex(&key);
|
|
+
|
|
+ /*
|
|
+ * We can race against put_pi_state() removing itself from the
|
|
+ * list (a waiter going away). put_pi_state() will first
|
|
+ * decrement the reference count and then modify the list, so
|
|
+ * its possible to see the list entry but fail this reference
|
|
+ * acquire.
|
|
+ *
|
|
+ * In that case; drop the locks to let put_pi_state() make
|
|
+ * progress and retry the loop.
|
|
+ */
|
|
+ if (!atomic_inc_not_zero(&pi_state->refcount)) {
|
|
+ raw_spin_unlock_irq(&curr->pi_lock);
|
|
+ cpu_relax();
|
|
+ raw_spin_lock_irq(&curr->pi_lock);
|
|
+ continue;
|
|
+ }
|
|
+
|
|
raw_spin_unlock_irq(&curr->pi_lock);
|
|
|
|
spin_lock(&hb->lock);
|
|
@@ -913,6 +931,7 @@ void exit_pi_state_list(struct task_struct *curr)
|
|
raw_spin_unlock_irq(&curr->pi_lock);
|
|
spin_unlock(&hb->lock);
|
|
raw_spin_lock_irq(&curr->pi_lock);
|
|
+ put_pi_state(pi_state);
|
|
continue;
|
|
}
|
|
|
|
@@ -922,7 +941,6 @@ void exit_pi_state_list(struct task_struct *curr)
|
|
pi_state->owner = NULL;
|
|
raw_spin_unlock_irq(&curr->pi_lock);
|
|
|
|
- get_pi_state(pi_state);
|
|
spin_unlock(&hb->lock);
|
|
|
|
rt_mutex_futex_unlock(&pi_state->pi_mutex);
|
|
--
|
|
2.7.4
|
|
|