Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1604944
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.10 59/63] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI |
| Date | 2017-03-20 19:20 +0100 |
| Message-ID | <tna4p-52-7@gated-at.bofh.it> (permalink) |
| References | <tn9L6-89w-87@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit c236c8e95a3d395b0494e7108f0d41cf36ec107c upstream.
While working on the futex code, I stumbled over this potential
use-after-free scenario. Dmitry triggered it later with syzkaller.
pi_mutex is a pointer into pi_state, which we drop the reference on in
unqueue_me_pi(). So any access to that pointer after that is bad.
Since other sites already do rt_mutex_unlock() with hb->lock held, see
for example futex_lock_pi(), simply move the unlock before
unqueue_me_pi().
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170304093558.801744246@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2813,7 +2813,6 @@ static int futex_wait_requeue_pi(u32 __u
{
struct hrtimer_sleeper timeout, *to = NULL;
struct rt_mutex_waiter rt_waiter;
- struct rt_mutex *pi_mutex = NULL;
struct futex_hash_bucket *hb;
union futex_key key2 = FUTEX_KEY_INIT;
struct futex_q q = futex_q_init;
@@ -2905,6 +2904,8 @@ static int futex_wait_requeue_pi(u32 __u
spin_unlock(q.lock_ptr);
}
} else {
+ struct rt_mutex *pi_mutex;
+
/*
* We have been woken up by futex_unlock_pi(), a timeout, or a
* signal. futex_unlock_pi() will not destroy the lock_ptr nor
@@ -2928,18 +2929,19 @@ static int futex_wait_requeue_pi(u32 __u
if (res)
ret = (res < 0) ? res : 0;
+ /*
+ * If fixup_pi_state_owner() faulted and was unable to handle
+ * the fault, unlock the rt_mutex and return the fault to
+ * userspace.
+ */
+ if (ret && rt_mutex_owner(pi_mutex) == current)
+ rt_mutex_unlock(pi_mutex);
+
/* Unqueue and drop the lock. */
unqueue_me_pi(&q);
}
- /*
- * If fixup_pi_state_owner() faulted and was unable to handle the
- * fault, unlock the rt_mutex and return the fault to userspace.
- */
- if (ret == -EFAULT) {
- if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
- rt_mutex_unlock(pi_mutex);
- } else if (ret == -EINTR) {
+ if (ret == -EINTR) {
/*
* We've already been requeued, but cannot restart by calling
* futex_lock_pi() directly. We could restart this syscall, but
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 31/63] net: fix socket refcounting in skb_complete_tx_timestamp() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 33/63] dccp: fix use-after-free in dccp_feat_activate_values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 32/63] net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 08/63] vti6: return GRE_KEY for vti6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 07/63] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 13/63] net sched actions: decrement module reference count after table flush. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 06/63] sctp: deny peeloff operation on asocs with threads sleeping on it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 35/63] vrf: Fix use-after-free in vrf_xmit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 16/63] geneve: lock RCU on TX path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 21/63] net: net_enable_timestamp() can be called from irq contexts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 40/63] mpls: Send route delete notifications when router module is unloaded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 36/63] net/tunnel: set inner protocol in network gro hooks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 29/63] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 27/63] bonding: use ETH_MAX_MTU as max mtu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
[PATCH 4.10 17/63] mlxsw: spectrum_router: Avoid potential packets loss Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 59/63] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 38/63] amd-xgbe: Enable IRQs only if napi_complete_done() is true Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 60/63] futex: Add missing error handling to FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 22/63] ipv6: orphan skbs in reassembly unit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 56/63] x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 49/63] arm64: KVM: VHE: Clear HCR_TGE when invalidating guest TLBs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 05/63] net/mlx5e: Fix wrong CQE decompression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 09/63] vxlan: dont allow overwrite of config src addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 43/63] ipv6: avoid write to a possibly cloned skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 61/63] locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 41/63] mpls: Do not decrement alive counter for unregister events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 15/63] vxlan: lock RCU on TX path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 03/63] net/mlx5e: Fix broken CQE compression initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 37/63] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 50/63] irqchip/gicv3-its: Add workaround for QDF2400 ITS erratum 0065 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 26/63] amd-xgbe: Dont overwrite SFP PHY mod_absent settings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 12/63] sctp: set sin_port for addr param when checking duplicate address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 23/63] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 04/63] net/mlx5e: Update MPWQE stride size when modifying CQE compress state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 10/63] ipv4: add missing initialization for flowi4_uid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 62/63] crypto: powerpc - Fix initialisation of crc32c context Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
[PATCH 4.10 25/63] amd-xgbe: Be sure to set MDIO modes on device (re)start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
Re: [PATCH 4.10 00/63] 4.10.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-21 01:20 +0100
Re: [PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-21 05:40 +0100
Re: [PATCH 4.10 00/63] 4.10.5-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-21 03:20 +0100
Re: [PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-21 05:50 +0100
csiph-web