linux-kernel - [PATCH]: Fix futex compat bug.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20070822.213153.94751711.davem@davemloft.net>
Date:	Wed, 22 Aug 2007 21:31:53 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	linux-kernel@...r.kernel.org
Subject: [PATCH]: Fix futex compat bug.

The futex list traversal on the compat side appears to have
a bug.

It's loop termination condition compares:

	while (compat_ptr(uentry) != &head->list)

But that can't be right because "uentry" has the special
"pi" indicator bit still potentially set at bit 0.  This
is cleared by fetch_robust_entry() into the "entry"
return value.

What this seems to mean is that the list won't terminate
when list iteration gets back to the the head.  And we'll
also process the list head like a normal entry, which could
cause all kinds of problems.

So we should check for equality with "entry".  That pointer
is of the non-compat type so we have to do a little casting
to keep the compiler and sparse happy.

Signed-off-by: David S. Miller <davem@...emloft.net>

diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index f792136..92af955 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -64,7 +64,7 @@ void compat_exit_robust_list(struct task_struct *curr)
 	if (upending)
 		handle_futex_death((void __user *)pending + futex_offset, curr, pip);

-	while (compat_ptr(uentry) != &head->list) {
+	while (entry != (struct robust_list *) &head->list) {
 		/*
 		 * A pending lock might already be on the list, so
 		 * dont process it twice:
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/