linux-kernel - Re: [PATCH v3] futex: don't leak robust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAH4c4jKEx4w3LobdSbixXBK4NaSdfa993YjNF_j_pZoqjieBOQ@mail.gmail.com>
Date: Wed, 13 Aug 2025 13:22:46 +0530
From: Pranav Tyagi <pranav.tyagi03@...il.com>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: mingo@...hat.com, peterz@...radead.org, dvhart@...radead.org, 
	dave@...olabs.net, andrealmeid@...lia.com, linux-kernel@...r.kernel.org, 
	jann@...jh.net, keescook@...omium.org, skhan@...uxfoundation.org, 
	linux-kernel-mentees@...ts.linux.dev
Subject: Re: [PATCH v3] futex: don't leak robust_list pointer on exec race

On Wed, Aug 6, 2025 at 3:17 AM Thomas Gleixner <tglx@...utronix.de> wrote:
>
> On Tue, Aug 05 2025 at 21:17, Pranav Tyagi wrote:
> > +
> > +     if (IS_ENABLED(CONFIG_COMPAT) && compat)
> > +             head = p->compat_robust_list;
>
> This still does not compile because the dead code elimination comes
> _after_ the compiler decodes this line. I don't even need to fire up a
> compiler to predict the error emitted when CONFIG_COMPAT=n:
>
>   error: ‘struct task_struct’ has no member named ‘compat_robust_list’
>
> No?
>
> There is a reason why I suggested you to use that helper function.
>
> You are obviously free to ignore me, but then please make sure that the
> stuff you submit compiles _AND_ works. Otherwise if you are not sure,
> why I told you, ask.
>
> Please take your time and stop rushing out half baken crap, which wastes
> everybodys time. I don't care about your time wasted, but I pretty much
> care about mine.
>
> To be clear: I don't want to see this in my inbox again before next week
> and then it better be correct.
>
> Thanks,
>
>         tglx
>
>
>

Hello Sir,

There is no question of ignoring you. It is my privilege to be
communicating with you.
Your guidance in the course of this specific patch has only enhanced
my understanding.
I always try to respect everyone's time and agree that I hurried the last one as
time of my mentorship program is closing fast. My apologies.

I have again sent the reworked patch (v4) duly corrected based on your
observations.
I have compiled and checked it with CONFIG_COMPAT=n. And to the extent
my little wisdom
allowed, I have tested it using the following custom testing code on a
virtual machine:

#define _GNU_SOURCE
#include <unistd.h>
#include <sys/syscall.h>
#include <linux/futex.h>
#include <linux/unistd.h>
#include <stdio.h>

int main() {
    pid_t pid = 0;  // 0 = self
    struct robust_list_head *head;
    size_t len;
    long ret;

    ret = syscall(SYS_get_robust_list, pid, &head, &len);
    if (ret == -1) {
        perror("get_robust_list");
        return 1;
    }

    printf("Robust list head: %p, length: %zu\n", head, len);
    return 0;
}

Regards
Pranav Tyagi