Re: [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI

From	Peter Zijlstra <peterz@infradead.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
Date	2016-12-01 06:40 +0100
Message-ID	<sJsg9-7Ys-3@gated-at.bofh.it> (permalink)
References	<sH3vA-43h-7@gated-at.bofh.it> <sH48j-4wC-91@gated-at.bofh.it> <sH4hZ-4Al-63@gated-at.bofh.it> <sJrDr-7sX-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Nov 30, 2016 at 08:55:30PM -0800, Darren Hart wrote:
> On Thu, Nov 24, 2016 at 04:38:08PM +0100, Peter Zijlstra wrote:

> > > In this path the fixup can return -EFAIL as well, so it should drop rtmutex
> > > too if it owns it. We should move the rtmutex drop into the fixup functions...
> > 
> > Urgh, so would really like to avoid doing that, I'll have to instantly
> > drag it back out again :/
> 
> Why would you have to drag it back out again? Something else you're working on?

Yeah, the very reason I've been staring at this mess in the first place
:-)

So I could point you at the patches; and I will, see:

  https://lkml.kernel.org/r/20161021122735.GA3117@twins.programming.kicks-ass.net

but the TL;DR version is that we must not rt_mutex_unlock() while
holding hb->lock, because on RT hb->lock is itself a rt_mutex which
gives rise to some very fun prio inversions.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Darren Hart <dvhart@infradead.org> - 2016-12-01 06:00 +0100
  Re: [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Peter Zijlstra <peterz@infradead.org> - 2016-12-01 06:40 +0100

csiph-web