From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762457AbXJMOyn (ORCPT ); Sat, 13 Oct 2007 10:54:43 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1761583AbXJMOmx (ORCPT ); Sat, 13 Oct 2007 10:42:53 -0400 Received: from 1wt.eu ([62.212.114.60]:3029 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1762053AbXJMOmu (ORCPT ); Sat, 13 Oct 2007 10:42:50 -0400 From: Willy Tarreau Message-Id: <20071013143503.%N@1wt.eu> References: <20071013142822.%N@1wt.eu> User-Agent: quilt/0.46-1 Date: Sat, 13 Oct 2007 17:28:45 +0200 To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Ingo Molnar , Thomas Gleixner , David Miller , Arnd Bergmann , Andrew Morton , Linus Torvalds , Greg Kroah-Hartman Subject: [2.6.20.21 review 23/35] futex_compat: fix list traversal bugs Content-Disposition: inline; filename=0078-futex_compat-fix-list-traversal-bugs.patch Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org commit 179c85ea53bef807621f335767e41e23f86f01df in mainline. The futex list traversal on the compat side appears to have a bug. It's loop termination condition compares: while (compat_ptr(uentry) != &head->list) But that can't be right because "uentry" has the special "pi" indicator bit still potentially set at bit 0. This is cleared by fetch_robust_entry() into the "entry" return value. What this seems to mean is that the list won't terminate when list iteration gets back to the the head. And we'll also process the list head like a normal entry, which could cause all kinds of problems. So we should check for equality with "entry". That pointer is of the non-compat type so we have to do a little casting to keep the compiler and sparse happy. The same problem can in theory occur with the 'pending' variable, although that has not been reported from users so far. Based on the original patch from David Miller. Acked-by: Ingo Molnar Cc: Thomas Gleixner Cc: David Miller Signed-off-by: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- kernel/futex_compat.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) Index: 2.6/kernel/futex_compat.c =================================================================== --- 2.6.orig/kernel/futex_compat.c +++ 2.6/kernel/futex_compat.c @@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task if (fetch_robust_entry(&upending, &pending, &head->list_op_pending, &pip)) return; - if (upending) + if (pending) handle_futex_death((void __user *)pending + futex_offset, curr, pip); - while (compat_ptr(uentry) != &head->list) { + while (entry != (struct robust_list __user *) &head->list) { /* * A pending lock might already be on the list, so * dont process it twice: --