Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c236c8e9 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Thomas Gleixner
Browse files

futex: Fix potential use-after-free in FUTEX_REQUEUE_PI 



While working on the futex code, I stumbled over this potential
use-after-free scenario. Dmitry triggered it later with syzkaller.

pi_mutex is a pointer into pi_state, which we drop the reference on in
unqueue_me_pi(). So any access to that pointer after that is bad.

Since other sites already do rt_mutex_unlock() with hb->lock held, see
for example futex_lock_pi(), simply move the unlock before
unqueue_me_pi().

Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarDarren Hart <dvhart@linux.intel.com>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20170304093558.801744246@infradead.org


Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent 4495c08e

kernel/futex.c

+11 −9
Original line number Diff line number Diff line
@@ -2815,7 +2815,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, 
{

	struct hrtimer_sleeper timeout, *to = NULL;

	struct rt_mutex_waiter rt_waiter;

	struct rt_mutex *pi_mutex = NULL;

	struct futex_hash_bucket *hb;

	union futex_key key2 = FUTEX_KEY_INIT;

	struct futex_q q = futex_q_init;
@@ -2907,6 +2906,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, 
			spin_unlock(q.lock_ptr);

		}

	} else {

		struct rt_mutex *pi_mutex;



		/*

		 * We have been woken up by futex_unlock_pi(), a timeout, or a

		 * signal.  futex_unlock_pi() will not destroy the lock_ptr nor
@@ -2930,18 +2931,19 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, 
		if (res)

			ret = (res < 0) ? res : 0;



		/*

		 * If fixup_pi_state_owner() faulted and was unable to handle

		 * the fault, unlock the rt_mutex and return the fault to

		 * userspace.

		 */

		if (ret && rt_mutex_owner(pi_mutex) == current)

			rt_mutex_unlock(pi_mutex);



		/* Unqueue and drop the lock. */

		unqueue_me_pi(&q);

	}



	/*

	 * If fixup_pi_state_owner() faulted and was unable to handle the

	 * fault, unlock the rt_mutex and return the fault to userspace.

	 */

	if (ret == -EFAULT) {

		if (pi_mutex && rt_mutex_owner(pi_mutex) == current)

			rt_mutex_unlock(pi_mutex);

	} else if (ret == -EINTR) {

	if (ret == -EINTR) {

		/*

		 * We've already been requeued, but cannot restart by calling

		 * futex_lock_pi() directly. We could restart this syscall, but