| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <000101ce4277$69df5af0$3d9e10d0$@com>
Date: Fri, 26 Apr 2013 20:13:00 +0800
From: "Zhang Yi" <wetpzy@...il.com>
To: <linux-kernel@...r.kernel.org>
Cc: "'Peter Zijlstra'" <peterz@...radead.org>,
"'Darren Hart'" <dvhart@...ux.intel.com>,
"'Thomas Gleixner'" <tglx@...utronix.de>,
"'Ingo Molnar'" <mingo@...nel.org>,
"'Dave Hansen'" <dave.hansen@...ux.intel.com>,
<zhang.yi20@....com.cn>, <wetpzy@....com>
Subject: [PATCH] futex: bugfix for futex-key conflict when futex use hugepage
Hi ,
At 2013-04-26 04:52:31,"Thomas Gleixner" <tglx@...utronix.de> wrote:
>
>Unfortunately this did not work out very well.
>
>1. Your patch now lacks a proper changelog which explains the change
>
>2. Your patch lacks any newline characters as you can see below
>
I am so sorry for my mistakes. : )
The futex-keys of processes share futex determined by page-offset, mapping-host, and
mapping-index of the user space address.
User appications using hugepage for futex may lead to futex-key conflict.
Assume there are two or more futexes in diffrent normal pages of the hugepage,
and each futex has the same offset in its normal page, causing all the futexes have the same futex-key.
In that case, futex may not work well.
This patch adds the normal page index in the compound page into the offset of futex-key.
Steps to reproduce the bug:
1. The 1st thread map a file of hugetlbfs, and use the return address as the 1st mutex's
address, and use the return address with PAGE_SIZE added as the 2nd mutex's address;
2. The 1st thread initialize the two mutexes with pshared attribute, and lock the two mutexes.
3. The 1st thread create the 2nd thread, and the 2nd thread block on the 1st mutex.
4. The 1st thread create the 3rd thread, and the 3rd thread block on the 2nd mutex.
5. The 1st thread unlock the 2nd mutex, the 3rd thread can not take the 2nd mutex, and
may block forever.
Signed-off-by: Zhang Yi <zhang.yi20@....com.cn>
Tested-by: Ma Chenggong <ma.chenggong@....com.cn>
Reviewed-by: Liu Dong <liu.dong3@....com.cn>
Reviewed-by: Cui Yunfeng <cui.yunfeng@....com.cn>
Reviewed-by: Lu Zhongjun <lu.zhongjun@....com.cn>
Reviewed-by: Jiang Biao <jiang.biao2@....com.cn>
diff -uprN orig/linux3.9-rc7/include/linux/futex.h new/linux3.9-rc7/include/linux/futex.h
--- orig/linux3.9-rc7/include/linux/futex.h 2013-04-15 00:45:16.000000000 +0000
+++ new/linux3.9-rc7/include/linux/futex.h 2013-04-19 16:33:58.725880000 +0000
@@ -19,7 +19,7 @@ handle_futex_death(u32 __user *uaddr, st
* The key type depends on whether it's a shared or private mapping.
* Don't rearrange members without looking at hash_futex().
*
- * offset is aligned to a multiple of sizeof(u32) (== 4) by definition.
+ * There are three components in offset:
* We use the two low order bits of offset to tell what is the kind of key :
* 00 : Private process futex (PTHREAD_PROCESS_PRIVATE)
* (no reference on an inode or mm)
@@ -27,6 +27,9 @@ handle_futex_death(u32 __user *uaddr, st
* mapped on a file (reference on the underlying inode)
* 10 : Shared futex (PTHREAD_PROCESS_SHARED)
* (but private mapping on an mm, and reference taken on it)
+ * Bits 2 to (PAGE_SHIFT-1) indicates the offset of futex in its page.
+ * The rest hign order bits indicates the index if the page is a
+ * subpage of a compound page.
*/
#define FUT_OFF_INODE 1 /* We set bit 0 if key has a reference on inode */
@@ -36,17 +39,17 @@ union futex_key {
struct {
unsigned long pgoff;
struct inode *inode;
- int offset;
+ long offset;
} shared;
struct {
unsigned long address;
struct mm_struct *mm;
- int offset;
+ long offset;
} private;
struct {
unsigned long word;
void *ptr;
- int offset;
+ long offset;
} both;
};
diff -uprN orig/linux3.9-rc7/kernel/futex.c new/linux3.9-rc7/kernel/futex.c
--- orig/linux3.9-rc7/kernel/futex.c 2013-04-15 00:45:16.000000000 +0000
+++ new/linux3.9-rc7/kernel/futex.c 2013-04-19 16:24:05.629143000 +0000
@@ -215,6 +215,22 @@ static void drop_futex_key_refs(union fu
}
}
+/*
+* Get subpage index in compound page, for futex_key.
+*/
+static inline int get_page_compound_index(struct page *page)
+{
+ struct page *head_page;
+ if (PageHead(page))
+ return 0;
+
+ head_page = compound_head(page);
+ if (compound_order(head_page) >= MAX_ORDER)
+ return page_to_pfn(page) - page_to_pfn(head_page);
+ else
+ return page - compound_head(page);
+}
+
/**
* get_futex_key() - Get parameters which are the keys for a futex
* @uaddr: virtual address of the futex
@@ -228,7 +244,8 @@ static void drop_futex_key_refs(union fu
* The key words are stored in *key on success.
*
* For shared mappings, it's (page->index, file_inode(vma->vm_file),
- * offset_within_page). For private mappings, it's (uaddr, current->mm).
+ * page_compound_index and offset_within_page).
+ * For private mappings, it's (uaddr, current->mm).
* We can usually work out the index without swapping in the page.
*
* lock_page() might sleep, the caller should not hold a spinlock.
@@ -239,7 +256,7 @@ get_futex_key(u32 __user *uaddr, int fsh
unsigned long address = (unsigned long)uaddr;
struct mm_struct *mm = current->mm;
struct page *page, *page_head;
- int err, ro = 0;
+ int err, ro = 0, comp_idx = 0;
/*
* The futex address must be "naturally" aligned.
@@ -299,6 +316,7 @@ again:
* freed from under us.
*/
if (page != page_head) {
+ comp_idx = get_page_compound_index(page);
get_page(page_head);
put_page(page);
}
@@ -311,6 +329,7 @@ again:
#else
page_head = compound_head(page);
if (page != page_head) {
+ comp_idx = get_page_compound_index(page);
get_page(page_head);
put_page(page);
}
@@ -363,7 +382,9 @@ again:
key->private.mm = mm;
key->private.address = address;
} else {
- key->both.offset |= FUT_OFF_INODE; /* inode-based key */
+ /* inode-based key */
+ key->both.offset |= ((long)comp_idx << PAGE_SHIFT)
+ | FUT_OFF_INODE;
key->shared.inode = page_head->mapping->host;
key->shared.pgoff = page_head->index;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists