linux-kernel - Re: [PATCH] futex: Resend potentially swallowed owner death notification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y3Ioe9xq6XE9fmgN@hirez.programming.kicks-ass.net>
Date:   Mon, 14 Nov 2022 12:37:31 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Alexey Izbyshev <izbyshev@...ras.ru>
Cc:     linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Darren Hart <dvhart@...radead.org>,
        Davidlohr Bueso <dave@...olabs.net>,
        André Almeida <andrealmeid@...lia.com>,
        Yi Wang <wang.yi59@....com.cn>,
        Yang Tao <yang.tao172@....com.cn>
Subject: Re: [PATCH] futex: Resend potentially swallowed owner death
 notification

On Sat, Nov 12, 2022 at 12:54:39AM +0300, Alexey Izbyshev wrote:
> Commit ca16d5bee598 ("futex: Prevent robust futex exit race") addressed
> two cases when tasks waiting on a robust non-PI futex remained blocked
> despite the futex not being owned anymore:
> 
> * if the owner died after writing zero to the futex word, but before
>   waking up a waiter
> 
> * if a task waiting on the futex was woken up, but died before updating
>   the futex word (effectively swallowing the notification without acting
>   on it)
> 
> In the second case, the task could be woken up either by the previous
> owner (after the futex word was reset to zero) or by the kernel (after
> the OWNER_DIED bit was set and the TID part of the futex word was reset
> to zero) if the previous owner died without the resetting the futex.
> Because the referenced commit wakes up a potential waiter only if the
> whole futex word is zero, the latter subcase remained unaddressed.
> 
> Fix this by looking only at the TID part of the futex when deciding
> whether a wake up is needed.
> 
> Fixes: ca16d5bee598 ("futex: Prevent robust futex exit race")
> Signed-off-by: Alexey Izbyshev <izbyshev@...ras.ru>

Acked-by: Peter Zijlstra (Intel) <peterz@...radead.org>