linux-kernel - [tip:core/futexes] futex: Deobfuscate handle_futex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-6e0aa9f8a8190e0879a29bd67aa606b51734a122@git.kernel.org>
Date:	Mon, 14 Mar 2011 20:15:46 GMT
From:	tip-bot for Thomas Gleixner <tglx@...utronix.de>
To:	linux-tip-commits@...r.kernel.org
Cc:	mingo@...hat.com, torvalds@...ux-foundation.org,
	schwidefsky@...ibm.com, peterz@...radead.org, cmetcalf@...era.com,
	tony.luck@...el.com, ralf@...ux-mips.org, monstr@...str.eu,
	linux@....linux.org.uk, tglx@...utronix.de,
	linux-kernel@...r.kernel.org, hpa@...or.com, darren@...art.com,
	lethal@...ux-sh.org, davem@...emloft.net, dhowells@...hat.com,
	benh@...nel.crashing.org, mattst88@...il.com,
	jejb@...isc-linux.org, walken@...gle.com
Subject: [tip:core/futexes] futex: Deobfuscate handle_futex_death()

Commit-ID:  6e0aa9f8a8190e0879a29bd67aa606b51734a122
Gitweb:     http://git.kernel.org/tip/6e0aa9f8a8190e0879a29bd67aa606b51734a122
Author:     Thomas Gleixner <tglx@...utronix.de>
AuthorDate: Mon, 14 Mar 2011 10:34:35 +0100
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Mon, 14 Mar 2011 21:08:47 +0100

futex: Deobfuscate handle_futex_death()

handle_futex_death() uses futex_atomic_cmpxchg_inatomic() without
disabling page faults. That's ok, but totally non obvious.

We don't hold locks so we actually can and want to fault here, because
the get_user() before futex_atomic_cmpxchg_inatomic() does not
guarantee a R/W mapping.

We could just add a big fat comment to explain this, but actually
changing the code so that the functionality is entirely clear is
better.

Use the helper function which disables page faults around the
futex_atomic_cmpxchg_inatomic() and handle a fault with a call to
fault_in_user_writeable() as all other places in the futex code do as
well.

Pointed-out-by: Linus Torvalds <torvalds@...ux-foundation.org>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Acked-by: Darren Hart <darren@...art.com>
Cc: Michel Lespinasse <walken@...gle.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Matt Turner <mattst88@...il.com>
Cc: Russell King <linux@....linux.org.uk>
Cc: David Howells <dhowells@...hat.com>
Cc: Tony Luck <tony.luck@...el.com>
Cc: Michal Simek <monstr@...str.eu>
Cc: Ralf Baechle <ralf@...ux-mips.org>
Cc: "James E.J. Bottomley" <jejb@...isc-linux.org>
Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
Cc: Martin Schwidefsky <schwidefsky@...ibm.com>
Cc: Paul Mundt <lethal@...ux-sh.org>
Cc: "David S. Miller" <davem@...emloft.net>
Cc: Chris Metcalf <cmetcalf@...era.com>
LKML-Reference: <alpine.LFD.2.00.1103141126590.2787@...alhost6.localdomain6>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
---
 kernel/futex.c |   17 ++++++++++++++---
 1 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index c6bef6e..e9251d9 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2458,9 +2458,20 @@ retry:
 		 * userspace.
 		 */
 		mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED;
-		if (futex_atomic_cmpxchg_inatomic(&nval, uaddr, uval, mval))
-			return -1;
-
+		/*
+		 * We are not holding a lock here, but we want to have
+		 * the pagefault_disable/enable() protection because
+		 * we want to handle the fault gracefully. If the
+		 * access fails we try to fault in the futex with R/W
+		 * verification via get_user_pages. get_user() above
+		 * does not guarantee R/W access. If that fails we
+		 * give up and leave the futex locked.
+		 */
+		if (cmpxchg_futex_value_locked(&nval, uaddr, uval, mval)) {
+			if (fault_in_user_writeable(uaddr))
+				return -1;
+			goto retry;
+		}
 		if (nval != uval)
 			goto retry;
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/