aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPeter Zijlstra <peterz@infradead.org>2017-10-31 06:18:53 -0400
committerIngo Molnar <mingo@kernel.org>2017-11-01 04:05:00 -0400
commit153fbd1226fb30b8630802aa5047b8af5ef53c9f (patch)
tree7ef6b0bf8b61afee4dd6ddc430ee3f512a1ba828
parent5f479447d983111c039f1d6d958553c1ad1b2ff1 (diff)
futex: Fix more put_pi_state() vs. exit_pi_state_list() races
Dmitry (through syzbot) reported being able to trigger the WARN in get_pi_state() and a use-after-free on: raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock); Both are due to this race: exit_pi_state_list() put_pi_state() lock(&curr->pi_lock) while() { pi_state = list_first_entry(head); hb = hash_futex(&pi_state->key); unlock(&curr->pi_lock); dec_and_test(&pi_state->refcount); lock(&hb->lock) lock(&pi_state->pi_mutex.wait_lock) // uaf if pi_state free'd lock(&curr->pi_lock); .... unlock(&curr->pi_lock); get_pi_state(); // WARN; refcount==0 The problem is we take the reference count too late, and don't allow it being 0. Fix it by using inc_not_zero() and simply retrying the loop when we fail to get a refcount. In that case put_pi_state() should remove the entry from the list. Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Cc: Gratian Crisan <gratian.crisan@ni.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: dvhart@infradead.org Cc: syzbot <bot+2af19c9e1ffe4d4ee1d16c56ae7580feaee75765@syzkaller.appspotmail.com> Cc: syzkaller-bugs@googlegroups.com Cc: <stable@vger.kernel.org> Fixes: c74aef2d06a9 ("futex: Fix pi_state->owner serialization") Link: http://lkml.kernel.org/r/20171031101853.xpfh72y643kdfhjs@hirez.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>
-rw-r--r--kernel/futex.c23
1 files changed, 20 insertions, 3 deletions
diff --git a/kernel/futex.c b/kernel/futex.c
index 0518a0bfc746..ca5bb9cba5cf 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -903,11 +903,27 @@ void exit_pi_state_list(struct task_struct *curr)
903 */ 903 */
904 raw_spin_lock_irq(&curr->pi_lock); 904 raw_spin_lock_irq(&curr->pi_lock);
905 while (!list_empty(head)) { 905 while (!list_empty(head)) {
906
907 next = head->next; 906 next = head->next;
908 pi_state = list_entry(next, struct futex_pi_state, list); 907 pi_state = list_entry(next, struct futex_pi_state, list);
909 key = pi_state->key; 908 key = pi_state->key;
910 hb = hash_futex(&key); 909 hb = hash_futex(&key);
910
911 /*
912 * We can race against put_pi_state() removing itself from the
913 * list (a waiter going away). put_pi_state() will first
914 * decrement the reference count and then modify the list, so
915 * its possible to see the list entry but fail this reference
916 * acquire.
917 *
918 * In that case; drop the locks to let put_pi_state() make
919 * progress and retry the loop.
920 */
921 if (!atomic_inc_not_zero(&pi_state->refcount)) {
922 raw_spin_unlock_irq(&curr->pi_lock);
923 cpu_relax();
924 raw_spin_lock_irq(&curr->pi_lock);
925 continue;
926 }
911 raw_spin_unlock_irq(&curr->pi_lock); 927 raw_spin_unlock_irq(&curr->pi_lock);
912 928
913 spin_lock(&hb->lock); 929 spin_lock(&hb->lock);
@@ -918,8 +934,10 @@ void exit_pi_state_list(struct task_struct *curr)
918 * task still owns the PI-state: 934 * task still owns the PI-state:
919 */ 935 */
920 if (head->next != next) { 936 if (head->next != next) {
937 /* retain curr->pi_lock for the loop invariant */
921 raw_spin_unlock(&pi_state->pi_mutex.wait_lock); 938 raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
922 spin_unlock(&hb->lock); 939 spin_unlock(&hb->lock);
940 put_pi_state(pi_state);
923 continue; 941 continue;
924 } 942 }
925 943
@@ -927,9 +945,8 @@ void exit_pi_state_list(struct task_struct *curr)
927 WARN_ON(list_empty(&pi_state->list)); 945 WARN_ON(list_empty(&pi_state->list));
928 list_del_init(&pi_state->list); 946 list_del_init(&pi_state->list);
929 pi_state->owner = NULL; 947 pi_state->owner = NULL;
930 raw_spin_unlock(&curr->pi_lock);
931 948
932 get_pi_state(pi_state); 949 raw_spin_unlock(&curr->pi_lock);
933 raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); 950 raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
934 spin_unlock(&hb->lock); 951 spin_unlock(&hb->lock);
935 952