linux-kernel - futex: Ahead futex_init from __initcall to core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 30 Dec 2016 16:17:55 +0800
From:   Yang Yang <yang.yang29@....com.cn>
To:     tglx@...utronix.de
Cc:     linux-kernel@...r.kernel.org, jiang.biao2@....com.cn,
        deng.huali@....com.cn, jiang.zhengxiong@....com.cn,
        zhong.weidong@....com.cn
Subject: futex: Ahead futex_init from __initcall to core_initcall

If configs UEVENT_HELPER_PATH [=/sbin/mdev](/sbin/mdev belongs to busybox),
the kernel may trigger oops and kill progress "mdev" when booting.

The reason is when the init progress is calling do_one_initcall(),devices
will be added and trigger /sbin/mdev to execute(in order to make device 
nodes automatically),then /sbin/mdev will call SyS_futex().But when 
SyS_futex() visit the global variable futex_queues,it maynot be 
initalized yet at this time.

Ahead futex_init from __initcall to core_initcall will make sure 
futex_queues is always initalized before the /sbin/mdev executes.

See oops below on arm CPU SABER.
The bug maynot occur due to different race conditions on different CPUs.
But it has a chance to occur by using QUME simulating x86 CPU with 
kernel linux-4.10-rc1.

Unable to handle kernel NULL pointer dereference at virtual 
address 00000000 pgd = ed100000
[00000000] *pgd=8e0b1831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] ARM
Modules linked in:
task: ed08b080 ti: ed0ea000 task.ti: ed0ea000
PC is at futex_wake+0x58/0x11c
LR is at futex_wake+0x48/0x11c
pc : [<c004baac>]    lr : [<c004ba9c>]    psr: a0000213
sp : ed0ebe98  ip : bec10000  fp : ed0ebecc
r10: 00000000  r9 : 00000001  r8 : 00000000
r7 : c088e700  r6 : ffffffff  r5 : 00000001  r4 : 00008114
r3 : 00000000  r2 : c088e700  r1 : 34a81583  r0 : fffffff4
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 12c53c7d  Table: 8e100059  DAC: 00000015
Process mdev (pid: 225, stack limit = 0xed0ea1b0)
Backtrace:
[<c004ba54>] (futex_wake+0x0/0x11c) from [<c004d3dc>]
[<c004d2b8>] (do_futex+0x0/0x870) from [<c004dbb0>] 
[<c004db28>] (SyS_futex+0x0/0x16c) from [<c0009240>]
Code: e1a07000 e5903000 e1500003 e243000c (e5934000)

Signed-off-by: Yang Yang <yang.yang29@....com.cn>

---
 kernel/futex.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 0842c8c..cdf3650 100755
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3323,4 +3323,4 @@ static int __init futex_init(void)

 	return 0;
 }
-__initcall(futex_init);
+core_initcall(futex_init);
-- 
1.7.1