Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1540909 > unrolled thread

[PATCH -v4 01/10] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH -v4 01/10] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Peter Zijlstra <peterz@infradead.org> - 2016-12-13 10:10 +0100
    Re: [PATCH -v4 01/10] futex: Fix potential use-after-free in  FUTEX_REQUEUE_PI Darren Hart <dvhart@infradead.org> - 2016-12-17 01:00 +0100

#1540909 — [PATCH -v4 01/10] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI

While working on the futex code, I stumbled over this potential
use-after-free scenario.

pi_mutex is a pointer into pi_state, which we drop the reference on in
unqueue_me_pi(). So any access to that pointer after that is bad.

Since other sites already do rt_mutex_unlock() with hb->lock held, see
for example futex_lock_pi(), simply move the unlock before
unqueue_me_pi().

Cc: Ingo Molnar <mingo@kernel.org>
Cc: dvhart@infradead.org
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
---
 kernel/futex.c |   20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2813,7 +2813,6 @@ static int futex_wait_requeue_pi(u32 __u
 {
 	struct hrtimer_sleeper timeout, *to = NULL;
 	struct rt_mutex_waiter rt_waiter;
-	struct rt_mutex *pi_mutex = NULL;
 	struct futex_hash_bucket *hb;
 	union futex_key key2 = FUTEX_KEY_INIT;
 	struct futex_q q = futex_q_init;
@@ -2905,6 +2904,8 @@ static int futex_wait_requeue_pi(u32 __u
 			spin_unlock(q.lock_ptr);
 		}
 	} else {
+		struct rt_mutex *pi_mutex;
+
 		/*
 		 * We have been woken up by futex_unlock_pi(), a timeout, or a
 		 * signal.  futex_unlock_pi() will not destroy the lock_ptr nor
@@ -2928,18 +2929,19 @@ static int futex_wait_requeue_pi(u32 __u
 		if (res)
 			ret = (res < 0) ? res : 0;
 
+		/*
+		 * If fixup_pi_state_owner() faulted and was unable to handle
+		 * the fault, unlock the rt_mutex and return the fault to
+		 * userspace.
+		 */
+		if (ret && rt_mutex_owner(pi_mutex) == current)
+			rt_mutex_unlock(pi_mutex);
+
 		/* Unqueue and drop the lock. */
 		unqueue_me_pi(&q);
 	}
 
-	/*
-	 * If fixup_pi_state_owner() faulted and was unable to handle the
-	 * fault, unlock the rt_mutex and return the fault to userspace.
-	 */
-	if (ret == -EFAULT) {
-		if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
-			rt_mutex_unlock(pi_mutex);
-	} else if (ret == -EINTR) {
+	if (ret == -EINTR) {
 		/*
 		 * We've already been requeued, but cannot restart by calling
 		 * futex_lock_pi() directly. We could restart this syscall, but

[toc] | [next] | [standalone]

#1543852 — Re: [PATCH -v4 01/10] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI

On Tue, Dec 13, 2016 at 09:36:39AM +0100, Peter Zijlstra wrote:
> While working on the futex code, I stumbled over this potential
> use-after-free scenario.
> 
> pi_mutex is a pointer into pi_state, which we drop the reference on in
> unqueue_me_pi(). So any access to that pointer after that is bad.
> 
> Since other sites already do rt_mutex_unlock() with hb->lock held, see
> for example futex_lock_pi(), simply move the unlock before
> unqueue_me_pi().

I believe this is unchanged from the previous version I reviewed. My only
comment would be possibly noting in the commit message that in addition to
EFAULT, ENOMEM and EHWPOISON from fixup_owner...fixup_user_fault() will now also
result in the unlock, we saw no reason to handle those cases differently, but in
case someone goes looking for the change, good to have it documented.

This passed my minimal testing (selftests/futex/functional in CI with kvm on a
dual socket Xeon "cpus=20,sockets=2,cores=5,threads=2").

Reviewed-by: Darren Hart <dvhart@linux.intel.com>

-- 
Darren Hart
Intel Open Source Technology Center

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web