Thomas Gleixner 6e7bfa046d futex: Handle faults correctly for PI futexes ... commit 34b1a1ce14 upstream fixup_pi_state_owner() tries to ensure that the state of the rtmutex, pi_state and the user space value related to the PI futex are consistent before returning to user space. In case that the user space value update faults and the fault cannot be resolved by faulting the page in via fault_in_user_writeable() the function returns with -EFAULT and leaves the rtmutex and pi_state owner state inconsistent. A subsequent futex_unlock_pi() operates on the inconsistent pi_state and releases the rtmutex despite not owning it which can corrupt the RB tree of the rtmutex and cause a subsequent kernel stack use after free. It was suggested to loop forever in fixup_pi_state_owner() if the fault cannot be resolved, but that results in runaway tasks which is especially undesired when the problem happens due to a programming error and not due to malice. As the user space value cannot be fixed up, the proper solution is to make the rtmutex and the pi_state consistent so both have the same owner. This leaves the user space value out of sync. Any subsequent operation on the futex will fail because the 10th rule of PI futexes (pi_state owner and user space value are consistent) has been violated. As a consequence this removes the inept attempts of 'fixing' the situation in case that the current task owns the rtmutex when returning with an unresolvable fault by unlocking the rtmutex which left pi_state::owner and rtmutex::owner out of sync in a different and only slightly less dangerous way. Fixes: 1b7558e457 ("futexes: fix fault handling in futex_lock_pi") Reported-by: gzobqq@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-30 13:32:13 +01:00
..
bpf	bpf: Fix a rcu warning for bpffs map pretty-print	2020-10-01 13:14:52 +02:00
cgroup	cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone()	2020-08-19 08:14:47 +02:00
configs
debug	kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"	2020-11-05 11:08:41 +01:00
dma	swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"	2020-11-18 19:18:51 +01:00
events	perf/core: Fix race in the perf_mmap_close() function	2020-11-18 19:18:52 +01:00
gcov	gcov: add support for GCC 10.1	2020-09-17 13:45:31 +02:00
irq	genirq/irqdomain: Don't try to free an interrupt that has no mapping	2020-12-30 11:25:58 +01:00
livepatch	livepatch: Nullify obj->mod in klp_module_coming()'s error path	2019-10-07 18:57:10 +02:00
locking	rtmutex: Remove unused argument from rt_mutex_proxy_unlock()	2021-01-30 13:32:12 +01:00
power	PM: hibernate: remove the bogus call to get_gendisk() in software_resume()	2020-10-30 10:38:28 +01:00
printk	printk: handle blank console arguments passed in.	2020-10-01 13:14:45 +02:00
rcu	rcu: Avoid data-race in rcu_gp_fqs_check_wake()	2020-02-11 04:33:55 -08:00
sched	sched: Reenable interrupts in do_sched_yield()	2020-12-30 11:25:50 +01:00
time	random32: make prandom_u32() output unpredictable	2020-11-18 19:18:52 +01:00
trace	tracing/kprobes: Do the notrace functions check without kprobes on ftrace	2021-01-19 18:22:35 +01:00
.gitignore
acct.c	acct_on(): don't mess with freeze protection	2019-05-31 06:46:05 -07:00
async.c
audit_fsnotify.c
audit_tree.c	audit: Embed key into chunk	2019-12-13 08:51:11 +01:00
audit_watch.c	audit: CONFIG_CHANGE don't log internal bookkeeping as an event	2020-10-01 13:14:33 +02:00
audit.c	audit: fix a net reference leak in audit_list_rules_send()	2020-06-22 09:05:13 +02:00
audit.h	audit: fix a net reference leak in audit_list_rules_send()	2020-06-22 09:05:13 +02:00
auditfilter.c	audit: fix a net reference leak in audit_list_rules_send()	2020-06-22 09:05:13 +02:00
auditsc.c	audit: print empty EXECVE args	2019-12-01 09:17:17 +01:00
backtracetest.c
bounds.c	kbuild: fix kernel/bounds.c 'W=1' warning	2018-11-13 11:08:47 -08:00
capability.c	LSM: generalize flag passing to security_capable	2020-01-23 08:21:29 +01:00
compat.c	make 'user_access_begin()' do 'access_ok()'	2020-06-22 09:04:58 +02:00
configs.c
context_tracking.c
cpu_pm.c	kernel/cpu_pm: Fix uninitted local in cpu_pm	2020-06-22 09:05:28 +02:00
cpu.c	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling	2020-12-30 11:25:45 +01:00
crash_core.c	kernel/crash_core.c: print timestamp using time64_t	2018-08-22 10:52:47 -07:00
crash_dump.c
cred.c	memcg: account security cred as well to kmemcg	2020-01-09 10:19:00 +01:00
delayacct.c
dma.c
elfcore.c	kernel/elfcore.c: include proper prototypes	2019-10-11 18:21:23 +02:00
exec_domain.c
exit.c	futex: Mark the begin of futex exit explicitly	2021-01-30 13:32:11 +01:00
extable.c
fail_function.c	fail_function: Remove a redundant mutex unlock	2020-11-24 13:27:23 +01:00
fork.c	futex: Split futex_mm_release() for exit/exec	2021-01-30 13:32:11 +01:00
freezer.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
futex.c	futex: Handle faults correctly for PI futexes	2021-01-30 13:32:13 +01:00
groups.c
hung_task.c	kernel: hung_task.c: disable on suspend	2019-04-20 09:16:02 +02:00
iomem.c
irq_work.c	irq_work: Do not raise an IPI when queueing work on the local CPU	2019-05-31 06:46:19 -07:00
jump_label.c	jump_label: move 'asm goto' support test to Kconfig	2019-06-04 08:02:34 +02:00
kallsyms.c	kallsyms: Refactor kallsyms_show_value() to take cred	2020-07-16 08:17:26 +02:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt	kconfig: include kernel/Kconfig.preempt from init/Kconfig	2018-08-02 08:06:54 +09:00
kcov.c	kernel/kcov.c: mark write_comp_data() as notrace	2019-02-12 19:47:20 +01:00
kexec_core.c	kexec: Allocate decrypted control pages for kdump if SME is enabled	2019-11-24 08:20:29 +01:00
kexec_file.c
kexec_internal.h
kexec.c	kexec: add call to LSM hook in original kexec_load syscall	2018-07-16 12:31:57 -07:00
kmod.c	kmod: make request_module() return an error when autoloading is disabled	2020-04-17 10:48:52 +02:00
kprobes.c	kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE	2020-10-01 13:14:54 +02:00
ksysfs.c
kthread.c	kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled	2020-11-10 12:35:58 +01:00
latencytop.c
Makefile	y2038: futex: Move compat implementation into futex.c	2019-12-01 09:17:38 +01:00
memremap.c	mm/memory_hotplug: shrink zones when offlining memory	2020-01-29 16:43:27 +01:00
module_signing.c	modsign: log module name in the event of an error	2018-07-02 11:36:17 +02:00
module-internal.h	modsign: log module name in the event of an error	2018-07-02 11:36:17 +02:00
module.c	module: delay kobject uevent until after module init call	2021-01-06 14:45:01 +01:00
notifier.c	x86/mm: split vmalloc_sync_all()	2020-03-25 08:06:13 +01:00
nsproxy.c
padata.c	padata: purge get_cpu and reorder_via_wq from padata_do_serial	2020-05-27 17:37:36 +02:00
panic.c	kernel/panic.c: do not append newline to the stack protector panic string	2019-12-01 09:17:10 +01:00
params.c
pid_namespace.c	signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig	2019-07-26 09:14:01 +02:00
pid.c	Fix failure path in alloc_pid()	2019-01-13 09:51:06 +01:00
profile.c
ptrace.c	ptrace: Set PF_SUPERPRIV when checking capability	2020-11-24 13:27:26 +01:00
range.c
reboot.c	reboot: fix overflow parsing reboot cpu number	2020-11-18 19:18:52 +01:00
relay.c	kernel/relay.c: fix memleak on destroy relay channel	2020-08-26 10:30:59 +02:00
resource.c	resource: fix locking in find_next_iomem_res()	2019-09-16 08:22:20 +02:00
rseq.c	rseq: uapi: Declare rseq_cs field as union, update includes	2018-07-10 22:18:52 +02:00
seccomp.c	seccomp: Set PF_SUPERPRIV when checking capability	2020-11-24 13:27:26 +01:00
signal.c	ptrace: fix task_join_group_stop() for the case when current is traced	2020-11-10 12:35:53 +01:00
smp.c	cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM	2019-02-12 19:47:25 +01:00
smpboot.c	smpboot: Remove cpumask from the API	2018-07-03 09:20:44 +02:00
smpboot.h
softirq.c	nohz: Fix missing tick reprogram when interrupting an inline softirq	2018-08-03 15:52:10 +02:00
stacktrace.c
stop_machine.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
sys_ni.c
sys.c	kernel/sys.c: avoid copying possible padding bytes in copy_to_user	2020-10-01 13:14:29 +02:00
sysctl_binary.c
sysctl.c	kernel: sysctl: make drop_caches write-only	2020-01-04 19:13:17 +01:00
task_work.c
taskstats.c	taskstats: fix data-race	2020-01-09 10:18:59 +01:00
test_kprobes.c
torture.c
tracepoint.c	tracepoint: Fix tracepoint array element size mismatch	2018-10-17 15:35:29 -04:00
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c	usermodehelper: reset umask to default before executing user process	2020-10-14 10:31:21 +02:00
up.c
user_namespace.c	userns: also map extents in the reverse map to kernel IDs	2018-11-13 11:09:00 -08:00
user-return-notifier.c
user.c	userns: use irqsave variant of refcount_dec_and_lock()	2018-08-22 10:52:47 -07:00
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-08-11 02:05:53 -05:00
utsname.c
watchdog_hld.c	watchdog: Mark watchdog touch functions as notrace	2018-08-30 12:56:40 +02:00
watchdog.c	watchdog/softlockup: Enforce that timestamp is valid on boot	2020-02-24 08:34:49 +01:00
workqueue_internal.h
workqueue.c	workqueue: Kick a worker based on the actual activation of delayed works	2021-01-12 20:10:16 +01:00