Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavidlohr Bueso <dbueso@suse.de>2014-09-18 15:09:38 +0200
committerDavidlohr Bueso <dbueso@suse.de>2014-09-18 15:09:38 +0200
commit44b8c9535d1565790e04d9423ebece4a3ce4c9b5 (patch)
tree6d8549f894f16786517bdea85445419cc81faffe
parentcb9fe08b23e62f90db447c468875bddcc0cd2c1a (diff)
futex: Unlock hb->lock in futex_wait_requeue_pi() error path
(fix bnc#880892).
-rw-r--r--patches.fixes/futex-Unlock-hb-lock-in-futex_wait_requeue_pi-error.patch52
-rw-r--r--series.conf1
2 files changed, 53 insertions, 0 deletions
diff --git a/patches.fixes/futex-Unlock-hb-lock-in-futex_wait_requeue_pi-error.patch b/patches.fixes/futex-Unlock-hb-lock-in-futex_wait_requeue_pi-error.patch
new file mode 100644
index 0000000000..963de6ea6e
--- /dev/null
+++ b/patches.fixes/futex-Unlock-hb-lock-in-futex_wait_requeue_pi-error.patch
@@ -0,0 +1,52 @@
+From 13c42c2f43b19aab3195f2d357db00d1e885eaa8 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 11 Sep 2014 23:44:35 +0200
+Subject: [PATCH] futex: Unlock hb->lock in futex_wait_requeue_pi() error path
+Git-commit: 13c42c2f43b19aab3195f2d357db00d1e885eaa8
+Patch-mainline: 3.17
+References: fix bnc#880892
+
+futex_wait_requeue_pi() calls futex_wait_setup(). If
+futex_wait_setup() succeeds it returns with hb->lock held and
+preemption disabled. Now the sanity check after this does:
+
+ if (match_futex(&q.key, &key2)) {
+ ret = -EINVAL;
+ goto out_put_keys;
+ }
+
+which releases the keys but does not release hb->lock.
+
+So we happily return to user space with hb->lock held and therefor
+preemption disabled.
+
+Unlock hb->lock before taking the exit route.
+
+Reported-by: Dave "Trinity" Jones <davej@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Darren Hart <dvhart@linux.intel.com>
+Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: stable@vger.kernel.org
+Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1409112318500.4178@nanos
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Davidloh Bueso <dbueso@suse.de>
+---
+ kernel/futex.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index d3a9d94..815d7af 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2592,6 +2592,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ * shared futexes. We need to compare the keys:
+ */
+ if (match_futex(&q.key, &key2)) {
++ queue_unlock(hb);
+ ret = -EINVAL;
+ goto out_put_keys;
+ }
+--
+1.8.4.5
+
diff --git a/series.conf b/series.conf
index 582ba057f3..302a766dcc 100644
--- a/series.conf
+++ b/series.conf
@@ -445,6 +445,7 @@
patches.fixes/0001-futex-Forbid-uaddr-uaddr2-in-requeue.patch
patches.fixes/0002-futex-Validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
+ patches.fixes/futex-Unlock-hb-lock-in-futex_wait_requeue_pi-error.patch
########################################################
# ia64