diff options
author | Peter Zijlstra <peterz@infradead.org> | 2017-10-31 06:18:53 -0400 |
---|---|---|
committer | Ingo Molnar <mingo@kernel.org> | 2017-11-01 04:05:00 -0400 |
commit | 153fbd1226fb30b8630802aa5047b8af5ef53c9f (patch) | |
tree | 7ef6b0bf8b61afee4dd6ddc430ee3f512a1ba828 | |
parent | 5f479447d983111c039f1d6d958553c1ad1b2ff1 (diff) |
futex: Fix more put_pi_state() vs. exit_pi_state_list() races
Dmitry (through syzbot) reported being able to trigger the WARN in
get_pi_state() and a use-after-free on:
raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
Both are due to this race:
exit_pi_state_list() put_pi_state()
lock(&curr->pi_lock)
while() {
pi_state = list_first_entry(head);
hb = hash_futex(&pi_state->key);
unlock(&curr->pi_lock);
dec_and_test(&pi_state->refcount);
lock(&hb->lock)
lock(&pi_state->pi_mutex.wait_lock) // uaf if pi_state free'd
lock(&curr->pi_lock);
....
unlock(&curr->pi_lock);
get_pi_state(); // WARN; refcount==0
The problem is we take the reference count too late, and don't allow it
being 0. Fix it by using inc_not_zero() and simply retrying the loop
when we fail to get a refcount. In that case put_pi_state() should
remove the entry from the list.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Gratian Crisan <gratian.crisan@ni.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: dvhart@infradead.org
Cc: syzbot <bot+2af19c9e1ffe4d4ee1d16c56ae7580feaee75765@syzkaller.appspotmail.com>
Cc: syzkaller-bugs@googlegroups.com
Cc: <stable@vger.kernel.org>
Fixes: c74aef2d06a9 ("futex: Fix pi_state->owner serialization")
Link: http://lkml.kernel.org/r/20171031101853.xpfh72y643kdfhjs@hirez.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-rw-r--r-- | kernel/futex.c | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/kernel/futex.c b/kernel/futex.c index 0518a0bfc746..ca5bb9cba5cf 100644 --- a/kernel/futex.c +++ b/kernel/futex.c | |||
@@ -903,11 +903,27 @@ void exit_pi_state_list(struct task_struct *curr) | |||
903 | */ | 903 | */ |
904 | raw_spin_lock_irq(&curr->pi_lock); | 904 | raw_spin_lock_irq(&curr->pi_lock); |
905 | while (!list_empty(head)) { | 905 | while (!list_empty(head)) { |
906 | |||
907 | next = head->next; | 906 | next = head->next; |
908 | pi_state = list_entry(next, struct futex_pi_state, list); | 907 | pi_state = list_entry(next, struct futex_pi_state, list); |
909 | key = pi_state->key; | 908 | key = pi_state->key; |
910 | hb = hash_futex(&key); | 909 | hb = hash_futex(&key); |
910 | |||
911 | /* | ||
912 | * We can race against put_pi_state() removing itself from the | ||
913 | * list (a waiter going away). put_pi_state() will first | ||
914 | * decrement the reference count and then modify the list, so | ||
915 | * its possible to see the list entry but fail this reference | ||
916 | * acquire. | ||
917 | * | ||
918 | * In that case; drop the locks to let put_pi_state() make | ||
919 | * progress and retry the loop. | ||
920 | */ | ||
921 | if (!atomic_inc_not_zero(&pi_state->refcount)) { | ||
922 | raw_spin_unlock_irq(&curr->pi_lock); | ||
923 | cpu_relax(); | ||
924 | raw_spin_lock_irq(&curr->pi_lock); | ||
925 | continue; | ||
926 | } | ||
911 | raw_spin_unlock_irq(&curr->pi_lock); | 927 | raw_spin_unlock_irq(&curr->pi_lock); |
912 | 928 | ||
913 | spin_lock(&hb->lock); | 929 | spin_lock(&hb->lock); |
@@ -918,8 +934,10 @@ void exit_pi_state_list(struct task_struct *curr) | |||
918 | * task still owns the PI-state: | 934 | * task still owns the PI-state: |
919 | */ | 935 | */ |
920 | if (head->next != next) { | 936 | if (head->next != next) { |
937 | /* retain curr->pi_lock for the loop invariant */ | ||
921 | raw_spin_unlock(&pi_state->pi_mutex.wait_lock); | 938 | raw_spin_unlock(&pi_state->pi_mutex.wait_lock); |
922 | spin_unlock(&hb->lock); | 939 | spin_unlock(&hb->lock); |
940 | put_pi_state(pi_state); | ||
923 | continue; | 941 | continue; |
924 | } | 942 | } |
925 | 943 | ||
@@ -927,9 +945,8 @@ void exit_pi_state_list(struct task_struct *curr) | |||
927 | WARN_ON(list_empty(&pi_state->list)); | 945 | WARN_ON(list_empty(&pi_state->list)); |
928 | list_del_init(&pi_state->list); | 946 | list_del_init(&pi_state->list); |
929 | pi_state->owner = NULL; | 947 | pi_state->owner = NULL; |
930 | raw_spin_unlock(&curr->pi_lock); | ||
931 | 948 | ||
932 | get_pi_state(pi_state); | 949 | raw_spin_unlock(&curr->pi_lock); |
933 | raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); | 950 | raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); |
934 | spin_unlock(&hb->lock); | 951 | spin_unlock(&hb->lock); |
935 | 952 | ||