Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavidlohr Bueso <dbueso@suse.de>2019-05-01 09:21:04 -0700
committerDavidlohr Bueso <dbueso@suse.de>2019-05-01 09:21:04 -0700
commitfd88aa520faf27ce8079ab3fa727679b0c8b6922 (patch)
tree4834ed82e85fd920f452f8bc6d05ec9b645504cf
parentc74e4c7a28fc2cb891e0964e56c12ba903d3717f (diff)
futex: Cure exit race (bsc#1050549).
-rw-r--r--patches.fixes/0001-futex-Cure-exit-race.patch181
-rw-r--r--series.conf1
2 files changed, 182 insertions, 0 deletions
diff --git a/patches.fixes/0001-futex-Cure-exit-race.patch b/patches.fixes/0001-futex-Cure-exit-race.patch
new file mode 100644
index 0000000000..b76a28b1a6
--- /dev/null
+++ b/patches.fixes/0001-futex-Cure-exit-race.patch
@@ -0,0 +1,181 @@
+From abefdef858eb95a5ceb5a594b85a51fcdedad11d Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 1 May 2019 09:18:02 -0700
+Subject: [PATCH] futex: Cure exit race
+Git-commit: da791a667536bf8322042e38ca85d55a78d3c273
+Patch-mainline: v4.20
+References: bsc#1050549
+
+Stefan reported, that the glibc tst-robustpi4 test case fails
+occasionally. That case creates the following race between
+sys_exit() and sys_futex_lock_pi():
+
+ CPU0 CPU1
+
+ sys_exit() sys_futex()
+ do_exit() futex_lock_pi()
+ exit_signals(tsk) No waiters:
+ tsk->flags |= PF_EXITING; *uaddr == 0x00000PID
+ mm_release(tsk) Set waiter bit
+ exit_robust_list(tsk) { *uaddr = 0x80000PID;
+ Set owner died attach_to_pi_owner() {
+ *uaddr = 0xC0000000; tsk = get_task(PID);
+ } if (!tsk->flags & PF_EXITING) {
+ ... attach();
+ tsk->flags |= PF_EXITPIDONE; } else {
+ if (!(tsk->flags & PF_EXITPIDONE))
+ return -EAGAIN;
+ return -ESRCH; <--- FAIL
+ }
+
+ESRCH is returned all the way to user space, which triggers the glibc test
+case assert. Returning ESRCH unconditionally is wrong here because the user
+space value has been changed by the exiting task to 0xC0000000, i.e. the
+FUTEX_OWNER_DIED bit is set and the futex PID value has been cleared. This
+is a valid state and the kernel has to handle it, i.e. taking the futex.
+
+Cure it by rereading the user space value when PF_EXITING and PF_EXITPIDONE
+is set in the task which 'owns' the futex. If the value has changed, let
+the kernel retry the operation, which includes all regular sanity checks
+and correctly handles the FUTEX_OWNER_DIED case.
+
+If it hasn't changed, then return ESRCH as there is no way to distinguish
+this case from malfunctioning user space. This happens when the exiting
+task did not have a robust list, the robust list was corrupted or the user
+space value in the futex was simply bogus.
+
+Reported-by: Stefan Liebler <stli@linux.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=200467
+Link: https://lkml.kernel.org/r/20181210152311.986181245@linutronix.de
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+
+---
+ kernel/futex.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 63 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 280c148acb2a..42b914d97ba3 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1162,11 +1162,65 @@ static int attach_to_pi_state(u32 __user *uaddr, u32 uval,
+ return ret;
+ }
+
++static int handle_exit_race(u32 __user *uaddr, u32 uval,
++ struct task_struct *tsk)
++{
++ u32 uval2;
++
++ /*
++ * If PF_EXITPIDONE is not yet set, then try again.
++ */
++ if (tsk && !(tsk->flags & PF_EXITPIDONE))
++ return -EAGAIN;
++
++ /*
++ * Reread the user space value to handle the following situation:
++ *
++ * CPU0 CPU1
++ *
++ * sys_exit() sys_futex()
++ * do_exit() futex_lock_pi()
++ * futex_lock_pi_atomic()
++ * exit_signals(tsk) No waiters:
++ * tsk->flags |= PF_EXITING; *uaddr == 0x00000PID
++ * mm_release(tsk) Set waiter bit
++ * exit_robust_list(tsk) { *uaddr = 0x80000PID;
++ * Set owner died attach_to_pi_owner() {
++ * *uaddr = 0xC0000000; tsk = get_task(PID);
++ * } if (!tsk->flags & PF_EXITING) {
++ * ... attach();
++ * tsk->flags |= PF_EXITPIDONE; } else {
++ * if (!(tsk->flags & PF_EXITPIDONE))
++ * return -EAGAIN;
++ * return -ESRCH; <--- FAIL
++ * }
++ *
++ * Returning ESRCH unconditionally is wrong here because the
++ * user space value has been changed by the exiting task.
++ *
++ * The same logic applies to the case where the exiting task is
++ * already gone.
++ */
++ if (get_futex_value_locked(&uval2, uaddr))
++ return -EFAULT;
++
++ /* If the user space value has changed, try again. */
++ if (uval2 != uval)
++ return -EAGAIN;
++
++ /*
++ * The exiting task did not have a robust list, the robust list was
++ * corrupted or the user space value in *uaddr is simply bogus.
++ * Give up and tell user space.
++ */
++ return -ESRCH;
++}
++
+ /*
+ * Lookup the task for the TID provided from user space and attach to
+ * it after doing proper sanity checks.
+ */
+-static int attach_to_pi_owner(u32 uval, union futex_key *key,
++static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
+ struct futex_pi_state **ps)
+ {
+ pid_t pid = uval & FUTEX_TID_MASK;
+@@ -1176,12 +1230,15 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
+ /*
+ * We are the first waiter - try to look up the real owner and attach
+ * the new pi_state to it, but bail out when TID = 0 [1]
++ *
++ * The !pid check is paranoid. None of the call sites should end up
++ * with pid == 0, but better safe than sorry. Let the caller retry
+ */
+ if (!pid)
+- return -ESRCH;
++ return -EAGAIN;
+ p = futex_find_get_task(pid);
+ if (!p)
+- return -ESRCH;
++ return handle_exit_race(uaddr, uval, NULL);
+
+ if (unlikely(p->flags & PF_KTHREAD)) {
+ put_task_struct(p);
+@@ -1201,7 +1258,7 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
+ * set, we know that the task has finished the
+ * cleanup:
+ */
+- int ret = (p->flags & PF_EXITPIDONE) ? -ESRCH : -EAGAIN;
++ int ret = handle_exit_race(uaddr, uval, p);
+
+ raw_spin_unlock_irq(&p->pi_lock);
+ put_task_struct(p);
+@@ -1258,7 +1315,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
+ * We are the first waiter - try to look up the owner based on
+ * @uval and attach to it.
+ */
+- return attach_to_pi_owner(uval, key, ps);
++ return attach_to_pi_owner(uaddr, uval, key, ps);
+ }
+
+ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
+@@ -1366,7 +1423,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
+ * attach to the owner. If that fails, no harm done, we only
+ * set the FUTEX_WAITERS bit in the user space variable.
+ */
+- return attach_to_pi_owner(uval, key, ps);
++ return attach_to_pi_owner(uaddr, newval, key, ps);
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index da2d073e46..946853ea46 100644
--- a/series.conf
+++ b/series.conf
@@ -20245,6 +20245,7 @@
patches.drm/0001-drm-ioctl-Fix-Spectre-v1-vulnerabilities.patch
patches.fixes/x86-mm-Fix-decoy-address-handling-vs-32-bit-builds.patch
patches.arch/x86-mtrr-don-t-copy-uninitialized-gentry-fields-back-to-userspace.patch
+ patches.fixes/0001-futex-Cure-exit-race.patch
patches.suse/tcp-fix-a-race-in-inet_diag_dump_icsk.patch
patches.suse/packet-validate-address-length.patch
patches.suse/ipv6-tunnels-fix-two-use-after-free.patch