Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi()

Browse source 
If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
as the trinity test suite manages to do, we miss early wakeups as
q.key is equal to key2 (because they are the same uaddr). We will then
attempt to dereference the pi_mutex (which would exist had the futex_q
been properly requeued to a pi futex) and trigger a NULL pointer
dereference.

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Dave Jones <davej@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/ad82bfe7f7d130247fbe2b5b4275654807774227.1342809673.git.dvhart@linux.intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
This commit is contained in:
Darren Hart 2012-07-20 11:53:31 -07:00 committed by Thomas Gleixner
parent f27071cb7f
commit 6f7b0a2a5c
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
kernel/futex.c
View file

@ -2231,11 +2231,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
* @uaddr2: the pi futex we will take prior to returning to user-space * @uaddr2: the pi futex we will take prior to returning to user-space
* *
* The caller will wait on uaddr and will be requeued by futex_requeue() to * The caller will wait on uaddr and will be requeued by futex_requeue() to
* uaddr2 which must be PI aware. Normal wakeup will wake on uaddr2 and * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake
* complete the acquisition of the rt_mutex prior to returning to userspace. * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to
* This ensures the rt_mutex maintains an owner when it has waiters; without * userspace. This ensures the rt_mutex maintains an owner when it has waiters;
* one, the pi logic wouldn't know which task to boost/deboost, if there was a * without one, the pi logic would not know which task to boost/deboost, if
* need to. * there was a need to.
* *
* We call schedule in futex_wait_queue_me() when we enqueue and return there * We call schedule in futex_wait_queue_me() when we enqueue and return there
* via the following: * via the following:
@ -2272,6 +2272,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
struct futex_q q = futex_q_init; struct futex_q q = futex_q_init;
int res, ret; int res, ret;
if (uaddr == uaddr2)
return -EINVAL;
if (!bitset) if (!bitset)
return -EINVAL; return -EINVAL;