From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Darren Hart <dvhart@linux.intel.com>,
Dave Jones <davej@redat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@elte.hu>, John Kacur <jkacur@redhat.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [ 17/37] futex: avoid wake_futex() for a PI futex_q
Date: Fri, 30 Nov 2012 10:46:04 -0800 [thread overview]
Message-ID: <20121130183859.088336238@linuxfoundation.org> (raw)
In-Reply-To: <20121130183857.166228045@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darren Hart <dvhart@linux.intel.com>
commit aa10990e028cac3d5e255711fb9fb47e00700e35 upstream.
Dave Jones reported a bug with futex_lock_pi() that his trinity test
exposed. Sometime between queue_me() and taking the q.lock_ptr, the
lock_ptr became NULL, resulting in a crash.
While futex_wake() is careful to not call wake_futex() on futex_q's with
a pi_state or an rt_waiter (which are either waiting for a
futex_unlock_pi() or a PI futex_requeue()), futex_wake_op() and
futex_requeue() do not perform the same test.
Update futex_wake_op() and futex_requeue() to test for q.pi_state and
q.rt_waiter and abort with -EINVAL if detected. To ensure any future
breakage is caught, add a WARN() to wake_futex() if the same condition
is true.
This fix has seen 3 hours of testing with "trinity -c futex" on an
x86_64 VM with 4 CPUS.
[akpm@linux-foundation.org: tidy up the WARN()]
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Reported-by: Dave Jones <davej@redat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: John Kacur <jkacur@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -843,6 +843,9 @@ static void wake_futex(struct futex_q *q
{
struct task_struct *p = q->task;
+ if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
+ return;
+
/*
* We set q->lock_ptr = NULL _before_ we wake up the task. If
* a non-futex wake up happens on another CPU then the task
@@ -1078,6 +1081,10 @@ retry_private:
plist_for_each_entry_safe(this, next, head, list) {
if (match_futex (&this->key, &key1)) {
+ if (this->pi_state || this->rt_waiter) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
wake_futex(this);
if (++ret >= nr_wake)
break;
@@ -1090,6 +1097,10 @@ retry_private:
op_ret = 0;
plist_for_each_entry_safe(this, next, head, list) {
if (match_futex (&this->key, &key2)) {
+ if (this->pi_state || this->rt_waiter) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
wake_futex(this);
if (++op_ret >= nr_wake2)
break;
@@ -1098,6 +1109,7 @@ retry_private:
ret += op_ret;
}
+out_unlock:
double_unlock_hb(hb1, hb2);
out_put_keys:
put_futex_key(&key2);
@@ -1387,9 +1399,13 @@ retry_private:
/*
* FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
* be paired with each other and no other futex ops.
+ *
+ * We should never be requeueing a futex_q with a pi_state,
+ * which is awaiting a futex_unlock_pi().
*/
if ((requeue_pi && !this->rt_waiter) ||
- (!requeue_pi && this->rt_waiter)) {
+ (!requeue_pi && this->rt_waiter) ||
+ this->pi_state) {
ret = -EINVAL;
break;
}
next prev parent reply other threads:[~2012-11-30 19:33 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-30 18:45 [ 00/37] 3.0.54-stable review Greg Kroah-Hartman
2012-11-30 18:45 ` [ 01/37] ALSA: pcmcia - Use pcmcia_request_irq() Greg Kroah-Hartman
2012-11-30 18:45 ` [ 02/37] drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning Greg Kroah-Hartman
2012-11-30 18:45 ` [ 03/37] drivers/block/DAC960: fix -Wuninitialized warning Greg Kroah-Hartman
2012-11-30 18:45 ` [ 04/37] riva/fbdev: fix several -Wuninitialized Greg Kroah-Hartman
2012-11-30 18:45 ` [ 05/37] ifenslave: Fix unused variable warnings Greg Kroah-Hartman
2012-11-30 18:45 ` [ 06/37] x86-32: Fix invalid stack address while in softirq Greg Kroah-Hartman
2012-12-04 13:42 ` Herton Ronaldo Krzesinski
2012-12-04 14:13 ` Robert Richter
2012-12-06 18:42 ` Greg Kroah-Hartman
2012-11-30 18:45 ` [ 07/37] x86, microcode, AMD: Add support for family 16h processors Greg Kroah-Hartman
2012-11-30 18:45 ` [ 08/37] rtlwifi: rtl8192cu: Add new USB ID Greg Kroah-Hartman
2012-11-30 18:45 ` [ 09/37] mwifiex: report error to MMC core if we cannot suspend Greg Kroah-Hartman
2012-11-30 18:45 ` [ 10/37] SCSI: isci: copy fis 0x34 response into proper buffer Greg Kroah-Hartman
2012-11-30 18:45 ` [ 11/37] ALSA: ua101, usx2y: fix broken MIDI output Greg Kroah-Hartman
2012-11-30 18:45 ` [ 12/37] ALSA: hda - Cirrus: Correctly clear line_out_pins when moving to speaker Greg Kroah-Hartman
2012-12-03 9:46 ` David Henningsson
2012-12-03 20:56 ` Greg Kroah-Hartman
2012-11-30 18:46 ` [ 13/37] PARISC: fix virtual aliasing issue in get_shared_area() Greg Kroah-Hartman
2012-11-30 18:46 ` [ 14/37] PARISC: fix user-triggerable panic on parisc Greg Kroah-Hartman
2012-11-30 18:46 ` [ 15/37] mtd: slram: invalid checking of absolute end address Greg Kroah-Hartman
2012-11-30 18:46 ` [ 16/37] dm: fix deadlock with request based dm and queue request_fn recursion Greg Kroah-Hartman
2012-11-30 18:46 ` Greg Kroah-Hartman [this message]
2012-11-30 18:46 ` [ 18/37] mac80211: deinitialize ibss-internals after emptiness check Greg Kroah-Hartman
2012-11-30 18:46 ` [ 19/37] radeon: add AGPMode 1 quirk for RV250 Greg Kroah-Hartman
2012-11-30 18:46 ` [ 20/37] can: bcm: initialize ifindex for timeouts without previous frame reception Greg Kroah-Hartman
2012-11-30 18:46 ` [ 21/37] jbd: Fix lock ordering bug in journal_unmap_buffer() Greg Kroah-Hartman
2012-11-30 18:46 ` [ 22/37] sparc64: not any error from do_sigaltstack() should fail rt_sigreturn() Greg Kroah-Hartman
2012-11-30 18:46 ` [ 23/37] ALSA: hda - Add new codec ALC283 ALC290 support Greg Kroah-Hartman
2012-11-30 18:46 ` [ 24/37] ALSA: hda - Fix missing beep on ASUS X43U notebook Greg Kroah-Hartman
2012-11-30 18:46 ` [ 25/37] ALSA: hda - Add support for Realtek ALC292 Greg Kroah-Hartman
2012-11-30 18:46 ` [ 26/37] bas_gigaset: fix pre_reset handling Greg Kroah-Hartman
2012-11-30 18:46 ` [ 27/37] ixgbe: add support for X540-AT1 Greg Kroah-Hartman
2012-11-30 18:46 ` [ 28/37] sata_svw: check DMA start bit before reset Greg Kroah-Hartman
2012-11-30 18:46 ` [ 29/37] ixgbe: add support for new 82599 device Greg Kroah-Hartman
2012-11-30 18:46 ` [ 30/37] ixgbe: add support for new 82599 device id Greg Kroah-Hartman
2012-11-30 18:46 ` [ 31/37] get_dvb_firmware: fix download site for tda10046 firmware Greg Kroah-Hartman
2012-11-30 18:46 ` [ 32/37] USB: mct_u232: fix broken close Greg Kroah-Hartman
2012-11-30 18:46 ` [ 33/37] watchdog: using u64 in get_sample_period() Greg Kroah-Hartman
2012-11-30 18:46 ` [ 34/37] acer-wmi: support for P key on TM8372 Greg Kroah-Hartman
2012-11-30 18:46 ` [ 35/37] x86, mce, therm_throt: Dont report power limit and package level thermal throttle events in mcelog Greg Kroah-Hartman
2012-11-30 18:46 ` [ 36/37] Input: bcm5974 - set BUTTONPAD property Greg Kroah-Hartman
2012-11-30 18:46 ` [ 37/37] mmc: sdhci-s3c: fix the wrong number of max bus clocks Greg Kroah-Hartman
2012-12-01 15:36 ` [ 00/37] 3.0.54-stable review Satoru Takeuchi
2012-12-01 16:24 ` David Miller
2012-12-01 17:15 ` Shuah Khan
2012-12-02 0:27 ` Satoru Takeuchi
2012-12-02 2:07 ` Shuah Khan
2012-12-02 17:01 ` Greg Kroah-Hartman
2012-12-02 19:36 ` Nikola Ciprich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121130183859.088336238@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davej@redat.com \
--cc=dvhart@linux.intel.com \
--cc=jkacur@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).