linux-kernel - Re: Q: sys_futex() && timespec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100628150208.GA13954@redhat.com>
Date:	Mon, 28 Jun 2010 17:02:08 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Jakub Jelinek <jakub@...hat.com>
Cc:	Ulrich Drepper <drepper@...hat.com>,
	Darren Hart <dvhltc@...ibm.com>, Ingo Molnar <mingo@...e.hu>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Thomas Gleixner <tglx@...utronix.de>,
	Andreas Schwab <schwab@...hat.com>,
	Danny Feng <dfeng@...hat.com>, linux-kernel@...r.kernel.org,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Subject: Re: Q: sys_futex() && timespec_valid()

On 06/28, Jakub Jelinek wrote:
>
> On Mon, Jun 28, 2010 at 03:58:25PM +0200, Oleg Nesterov wrote:
> > Honestly, it looks a bit strange to me that you blame the correct code,
>
> Whether that is correct or not is what is being disputed.

OK. I only argued with the "buggy" term. Once again, the code works
as expected.

> > and at the same time you ignore the test-case which hangs because the
> > kernel returns -EFAULT saying that this is the caller's problem.
>
> The userspace code reads the abstime->tv_nsec value, so if it wouldn't
> be valid address, the code would already segfault.  And that's fine, POSIX
> certainly allows that, reporting EFAULT isn't required.  Well, it doesn't
> read abstime->tv_sec in the assembly version, so if you try hard, you can
> avoid the segfault, yet get EFAULT from futex syscall by putting abstime
> 8 bytes before start of some page with previous page not mmapped.

And this is exactly what I did to prove that (in my opinion) libc needs
fixes anyway, even if we change the kernel to treat tv_sec < 0 specially.

	#include <stdio.h>
	#include <unistd.h>
	#include <pthread.h>
	#include <sys/mman.h>

	pthread_rwlock_t rwlock;

	static struct timespec *make_efault_ts(void)
	{
		int page_size = sysconf(_SC_PAGESIZE);
		void *ptr = mmap(0, 2 * page_size, PROT_READ|PROT_WRITE,
					MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
		munmap(ptr, page_size);
		return ptr + page_size - sizeof(long);
	}

	static void *thread_func(void *arg)
	{
		int ret = pthread_rwlock_timedwrlock(&rwlock, make_efault_ts());
		printf("lock: ret=%d %m\n", ret);
		return NULL;
	}

	int main(int argv, char *argc[])
	{
		pthread_t tid;

		pthread_rwlock_init(&rwlock, NULL);
		pthread_rwlock_wrlock(&rwlock);

		pthread_create(&tid, NULL, thread_func, NULL);
		pthread_join(tid, NULL);

		return 0;
	}

It may hang or segfault on your machine, this depends on libc version.
It hangs on the testing machine which also suffers from the reported
timespec_valid() issue. I did this test-case looking at
"objdump -d /lib64/libpthread.so".

To me, this looks like a bug in libc, but I won't insist.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/