github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

- Fix the incorrect RCU protection in rt_spin_unlock()

Browse Source 
(Thomas Gleixner)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmo6u1wRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1inTg/+K9TZr6kE3/Q53VSpGZfk40+Fsrt87Wq1
 Bx9u6jsvSGQ2JuchwcPyQB15/zMHrRsEAZ5+oLm7ZI7faCe2EuyrYPuQ02eH1rzI
 7lKYJhW//hV6GbtnFdF0WcTHIHpRS6jaiMToxbiX+jrR+vuTBdSALXjyJuZsc36v
 9IpdJrA7c7UU5FDC1uHOGzQihf3Zij3+FF1CK/wl91NOSU/mzDZ0lb+LRxvnFUsR
 RqMMwYZGKWlw6JHA3cu1lFBqodQlpr/AP2usOTHC2L7+1zrQwnBXNOC3ZPy14gKd
 cSD2KzF/cbjdI+JyoYkWwTp6xeSONpylFbBNOu2uocI0czcASLAtfUN6sxqLk+DQ
 9oLCwPDtpTA9IfpQYPhQt+Kt8Sh2o8YNRQIt1ihZ7KAgBfOUYnBGBzxeK3TIfOlS
 kLW2I1i1UxdYN1FQSzZ/3IQEMQyYEzO/W3A5jr1Rr7k0duZJPCq6Hjt3W58IlS9q
 91kre98ARMBJkZ2zQAuXXk9zWA2NpjYNck9vWvBIswFLx6nUc+GqSNZ7+TWBJTgy
 8V5urP6Y0zqrLuafwf5fvxviTVXwuXt+3qUYKgRIBUIRk59RbpuMwQhb/d2RGW8X
 qKdjvp8nSdTbYdYxOCOt/gngsZmifeXVTIT/iWMCGpArILdijJHwFs3labFpXthi
 dUEim9WgfiE=
 =6OD/
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fix from Ingo Molnar:

 - Fix the incorrect RCU protection in rt_spin_unlock() (Thomas
   Gleixner)

* tag 'locking-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
This commit is contained in:
Linus Torvalds 2026-06-23 16:15:53 -07:00
commit d1c4b50f88
1 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
kernel/locking/spinlock_rt.c
View File

@ -79,10 +79,27 @@ void __sched rt_spin_unlock(spinlock_t *lock) __releases(RCU)
{
spin_release(&lock->dep_map, _RET_IP_);
migrate_enable();
rcu_read_unlock();
if (unlikely(!rt_mutex_cmpxchg_release(&lock->lock, current, NULL)))
rt_mutex_slowunlock(&lock->lock);
/*
* This must be last to prevent the following UAF:
*
* T1 T2
* spin_lock(&p->lock); rcu_read_lock();
* invalidate(p); p = rcu_dereference(ptr);
* rcu_assign_pointer(ptr, NULL); if (!p) return;
* spin_unlock(&p->lock); spin_lock(&p->lock);
* kfree_rcu(p); rcu_read_unlock();
* ....
* spin_unlock(&p->lock)
* rcu_read_unlock(); // Ends grace period
* rcu_do_batch()
* kfree(p);
* UAF -> rt_mutex_cmpxchg_release(&p->lock.lock...)
*/
rcu_read_unlock();
}
EXPORT_SYMBOL(rt_spin_unlock);
@ -262,17 +279,21 @@ void __sched rt_read_unlock(rwlock_t *rwlock) __releases(RCU)
{
rwlock_release(&rwlock->dep_map, _RET_IP_);
migrate_enable();
rcu_read_unlock();
rwbase_read_unlock(&rwlock->rwbase, TASK_RTLOCK_WAIT);
/* This must be last. See comment in rt_spin_unlock() */
rcu_read_unlock();
}
EXPORT_SYMBOL(rt_read_unlock);
void __sched rt_write_unlock(rwlock_t *rwlock) __releases(RCU)
{
rwlock_release(&rwlock->dep_map, _RET_IP_);
rcu_read_unlock();
migrate_enable();
rwbase_write_unlock(&rwlock->rwbase);
/* This must be last. See comment in rt_spin_unlock() */
rcu_read_unlock();
}
EXPORT_SYMBOL(rt_write_unlock);