linux-kernel - Re: [RFC][PATCH] muptiple bugs in PI futexes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 May 2007 09:26:09 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Alexey Kuznetsov <kuznet@....inr.ac.ru>
Cc:	linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [RFC][PATCH] muptiple bugs in PI futexes


* Alexey Kuznetsov <kuznet@....inr.ac.ru> wrote:

> Hello!
> 
> 1. New entries can be added to tsk->pi_state_list after task completed
>    exit_pi_state_list(). The result is memory leakage and deadlocks.
> 
> 2. handle_mm_fault() is called under spinlock. The result is obvious.
> 
> 3. State machine is broken. Kernel thinks it owns futex after
>    it released all the locks. Ergo, it corrupts futex. The result is that
>    two processes think they took a futex.
> 
> All the bugs are trivially reproduced when running glibc's tst-robustpi7
> test long enough.
> 
> The patch is not quite good (RFC!), because:
> 
> 1. There is one case, when I did not figure out how to handle
>    page fault correctly. I would do it releasing taken rtmutex
>    and hb->lock and retrying futex from the very beginning.
>    It is quite ugly. Probably, state machine can be fixed somehow.
> 
> 2. Before this patch I had one unexplained oops inside rtmutex
>    in plist_del. I did _not_ fix this, but it does not want to reproduce.
>    Probably, more strong locking did some race window too narrow.

thanks for the fixes - they look all good and we'll check it in -rt. 
We'll try to find a solution for the remaining problem too. Could your
#2 crash be explained via any of the bugs you fixed? (i.e. memory
corruption?) I'd exclude genuine rtmutex.c breakage for now because 
that's the basis of all locking in -rt - but maybe the futex interfacing 
upsets something ...

	Ingo
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/