From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757373AbcLTGeV (ORCPT ); Tue, 20 Dec 2016 01:34:21 -0500 Received: from mail-wj0-f193.google.com ([209.85.210.193]:33445 "EHLO mail-wj0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751873AbcLTGeT (ORCPT ); Tue, 20 Dec 2016 01:34:19 -0500 From: Manfred Spraul To: LKML , Andrew Morton , Davidlohr Bueso Cc: 1vier1@web.de, dvyukov@google.com, mingo@kernel.org, peterz@infradead.org, fabf@skynet.be, kernel@kyup.com, syzkaller@googlegroups.com, Manfred Spraul Subject: [PATCH v2] ipc/sem.c: fix incorrect sem_lock pairing Date: Tue, 20 Dec 2016 07:34:05 +0100 Message-Id: <1482215645-22328-1-git-send-email-manfred@colorfullife.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Based on the syzcaller test case from dvyukov: https://gist.githubusercontent.com/dvyukov/d0e5efefe4d7d6daed829f5c3ca26a40/raw/08d0a261fe3c987bed04fbf267e08ba04bd533ea/gistfile1.txt The slow (i.e.: failure to acquire) syscall exit from semtimedop() incorrectly assumed that the the same lock is acquired as it was at the initial syscall entry. This is wrong: - thread A: single semop semop(), sleeps - thread B: multi semop semop(), sleeps - thread A: woken up by signal/timeout With this sequence, the initial sem_lock() call locks the per-semaphore spinlock, and it is unlocked with sem_unlock(). The call at the syscall return locks the global spinlock. Because locknum is not updated, the following sem_unlock() call unlocks the per-semaphore spinlock, which is actually not locked. The fix is trivial: Use the return value from sem_lock. Reported-by: dvyukov@google.com Signed-off-by: Manfred Spraul Fixes: 370b262c896e ("ipc/sem: avoid idr tree lookup for interrupted semop") Cc: dave@stgolabs.net --- Patch V2: - subject line updated - documentation slightly updated ipc/sem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipc/sem.c b/ipc/sem.c index e08b948..3ec5742 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -1977,7 +1977,7 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops, } rcu_read_lock(); - sem_lock(sma, sops, nsops); + locknum = sem_lock(sma, sops, nsops); if (!ipc_valid_object(&sma->sem_perm)) goto out_unlock_free; -- 2.7.4