From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Darren Hart <dvhart@linux.intel.com>,
Dave Jones <davej@redat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@elte.hu>, John Kacur <jkacur@redhat.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [ 28/56] futex: avoid wake_futex() for a PI futex_q
Date: Fri, 30 Nov 2012 10:55:20 -0800 [thread overview]
Message-ID: <20121130185121.120203034@linuxfoundation.org> (raw)
In-Reply-To: <20121130185118.302752929@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darren Hart <dvhart@linux.intel.com>
commit aa10990e028cac3d5e255711fb9fb47e00700e35 upstream.
Dave Jones reported a bug with futex_lock_pi() that his trinity test
exposed. Sometime between queue_me() and taking the q.lock_ptr, the
lock_ptr became NULL, resulting in a crash.
While futex_wake() is careful to not call wake_futex() on futex_q's with
a pi_state or an rt_waiter (which are either waiting for a
futex_unlock_pi() or a PI futex_requeue()), futex_wake_op() and
futex_requeue() do not perform the same test.
Update futex_wake_op() and futex_requeue() to test for q.pi_state and
q.rt_waiter and abort with -EINVAL if detected. To ensure any future
breakage is caught, add a WARN() to wake_futex() if the same condition
is true.
This fix has seen 3 hours of testing with "trinity -c futex" on an
x86_64 VM with 4 CPUS.
[akpm@linux-foundation.org: tidy up the WARN()]
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Reported-by: Dave Jones <davej@redat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: John Kacur <jkacur@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -843,6 +843,9 @@ static void wake_futex(struct futex_q *q
{
struct task_struct *p = q->task;
+ if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
+ return;
+
/*
* We set q->lock_ptr = NULL _before_ we wake up the task. If
* a non-futex wake up happens on another CPU then the task
@@ -1078,6 +1081,10 @@ retry_private:
plist_for_each_entry_safe(this, next, head, list) {
if (match_futex (&this->key, &key1)) {
+ if (this->pi_state || this->rt_waiter) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
wake_futex(this);
if (++ret >= nr_wake)
break;
@@ -1090,6 +1097,10 @@ retry_private:
op_ret = 0;
plist_for_each_entry_safe(this, next, head, list) {
if (match_futex (&this->key, &key2)) {
+ if (this->pi_state || this->rt_waiter) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
wake_futex(this);
if (++op_ret >= nr_wake2)
break;
@@ -1098,6 +1109,7 @@ retry_private:
ret += op_ret;
}
+out_unlock:
double_unlock_hb(hb1, hb2);
out_put_keys:
put_futex_key(&key2);
@@ -1387,9 +1399,13 @@ retry_private:
/*
* FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
* be paired with each other and no other futex ops.
+ *
+ * We should never be requeueing a futex_q with a pi_state,
+ * which is awaiting a futex_unlock_pi().
*/
if ((requeue_pi && !this->rt_waiter) ||
- (!requeue_pi && this->rt_waiter)) {
+ (!requeue_pi && this->rt_waiter) ||
+ this->pi_state) {
ret = -EINVAL;
break;
}
next prev parent reply other threads:[~2012-11-30 18:56 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-30 18:54 [ 00/56] 3.4.21-stable review Greg Kroah-Hartman
2012-11-30 18:54 ` [ 01/56] UBIFS: fix compilation warning Greg Kroah-Hartman
2012-11-30 18:54 ` [ 02/56] NVMe: Fix uninitialized iod compiler warning Greg Kroah-Hartman
2012-11-30 18:54 ` [ 03/56] Bluetooth: Fix using uninitialized option in RFCMode Greg Kroah-Hartman
2012-11-30 18:54 ` [ 04/56] ALSA: snd-usb-caiaq: initialize card pointer Greg Kroah-Hartman
2012-11-30 18:54 ` [ 05/56] drivers/leds/leds-lp5521.c: fix lp5521_read() error handling Greg Kroah-Hartman
2012-12-02 3:17 ` Ben Hutchings
2012-12-02 8:05 ` Dan Carpenter
2012-12-02 17:29 ` [patch] leds: leds-lp5521: return an error code on error in probe() Dan Carpenter
2012-12-03 19:18 ` Bryan Wu
2012-11-30 18:54 ` [ 06/56] [SCSI] mvsas: remove unused variable in mvs_task_exec() Greg Kroah-Hartman
2012-11-30 18:54 ` [ 07/56] scsi: aha152x: Fix sparse warning and make printing pointer address more portable Greg Kroah-Hartman
2012-11-30 18:55 ` [ 08/56] rtlwifi: rtl8192se: Fix gcc 4.7.x warning Greg Kroah-Hartman
2012-11-30 18:55 ` [ 09/56] x86-32: Fix invalid stack address while in softirq Greg Kroah-Hartman
2012-12-04 13:56 ` Herton Ronaldo Krzesinski
2012-12-06 18:42 ` Greg Kroah-Hartman
2012-11-30 18:55 ` [ 10/56] x86, efi: Fix processor-specific memcpy() build error Greg Kroah-Hartman
2012-11-30 18:55 ` [ 11/56] x86, microcode, AMD: Add support for family 16h processors Greg Kroah-Hartman
2012-11-30 18:55 ` [ 12/56] rtlwifi: rtl8192cu: Add new USB ID Greg Kroah-Hartman
2012-11-30 18:55 ` [ 13/56] mwifiex: report error to MMC core if we cannot suspend Greg Kroah-Hartman
2012-11-30 18:55 ` [ 14/56] mwifiex: fix system hang issue in cmd timeout error case Greg Kroah-Hartman
2012-11-30 18:55 ` [ 15/56] SCSI: isci: copy fis 0x34 response into proper buffer Greg Kroah-Hartman
2012-11-30 18:55 ` [ 16/56] drm/radeon: add new SI pci id Greg Kroah-Hartman
2012-11-30 18:55 ` [ 17/56] ALSA: ua101, usx2y: fix broken MIDI output Greg Kroah-Hartman
2012-11-30 18:55 ` [ 18/56] ALSA: hda - Cirrus: Correctly clear line_out_pins when moving to speaker Greg Kroah-Hartman
2012-11-30 18:55 ` [ 19/56] PARISC: fix virtual aliasing issue in get_shared_area() Greg Kroah-Hartman
2012-11-30 18:55 ` [ 20/56] PARISC: fix user-triggerable panic on parisc Greg Kroah-Hartman
2012-11-30 18:55 ` [ 21/56] mtd: slram: invalid checking of absolute end address Greg Kroah-Hartman
2012-11-30 18:55 ` [ 22/56] mtd: ofpart: Fix incorrect NULL check in parse_ofoldpart_partitions() Greg Kroah-Hartman
2012-11-30 18:55 ` [ 23/56] jffs2: Fix lock acquisition order bug in jffs2_write_begin Greg Kroah-Hartman
2012-11-30 18:55 ` [ 24/56] md: Reassigned the parameters if read_seqretry returned true in func md_is_badblock Greg Kroah-Hartman
2012-11-30 18:55 ` [ 25/56] md: Avoid write invalid address if read_seqretry returned true Greg Kroah-Hartman
2012-11-30 18:55 ` [ 26/56] md/raid10: decrement correct pending counter when writing to replacement Greg Kroah-Hartman
2012-11-30 18:55 ` [ 27/56] dm: fix deadlock with request based dm and queue request_fn recursion Greg Kroah-Hartman
2012-11-30 18:55 ` Greg Kroah-Hartman [this message]
2012-11-30 18:55 ` [ 29/56] mac80211: deinitialize ibss-internals after emptiness check Greg Kroah-Hartman
2012-11-30 18:55 ` [ 30/56] radeon: add AGPMode 1 quirk for RV250 Greg Kroah-Hartman
2012-11-30 18:55 ` [ 31/56] can: peak_usb: fix hwtstamp assignment Greg Kroah-Hartman
2012-11-30 18:55 ` [ 32/56] can: bcm: initialize ifindex for timeouts without previous frame reception Greg Kroah-Hartman
2012-11-30 18:55 ` [ 33/56] jbd: Fix lock ordering bug in journal_unmap_buffer() Greg Kroah-Hartman
2012-11-30 18:55 ` [ 34/56] sparc64: not any error from do_sigaltstack() should fail rt_sigreturn() Greg Kroah-Hartman
2012-11-30 18:55 ` [ 35/56] PM / QoS: fix wrong error-checking condition Greg Kroah-Hartman
2012-11-30 18:55 ` [ 36/56] ALSA: hda - Add new codec ALC283 ALC290 support Greg Kroah-Hartman
2012-11-30 18:55 ` [ 37/56] ALSA: hda - Fix missing beep on ASUS X43U notebook Greg Kroah-Hartman
2012-11-30 18:55 ` [ 38/56] ALSA: hda - Add support for Realtek ALC292 Greg Kroah-Hartman
2012-11-30 18:55 ` [ 39/56] bas_gigaset: fix pre_reset handling Greg Kroah-Hartman
2012-11-30 18:55 ` [ 40/56] scsi: Silence unnecessary warnings about ioctl to partition Greg Kroah-Hartman
2012-11-30 18:55 ` [ 41/56] KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set (CVE-2012-4461) Greg Kroah-Hartman
2012-11-30 18:55 ` [ 42/56] ixgbe: add support for X540-AT1 Greg Kroah-Hartman
2012-11-30 18:55 ` [ 43/56] sata_svw: check DMA start bit before reset Greg Kroah-Hartman
2012-11-30 18:55 ` [ 44/56] get_dvb_firmware: fix download site for tda10046 firmware Greg Kroah-Hartman
2012-11-30 18:55 ` [ 45/56] NFC: pn533: Fix use after free Greg Kroah-Hartman
2012-11-30 18:55 ` [ 46/56] NFC: pn533: Fix mem leak in pn533_in_dep_link_up Greg Kroah-Hartman
2012-11-30 18:55 ` [ 47/56] NFC: Fix nfc_llcp_local chained list insertion Greg Kroah-Hartman
2012-11-30 18:55 ` [ 48/56] USB: mct_u232: fix broken close Greg Kroah-Hartman
2012-11-30 18:55 ` [ 49/56] watchdog: using u64 in get_sample_period() Greg Kroah-Hartman
2012-11-30 18:55 ` [ 50/56] MPI: Fix compilation on MIPS with GCC 4.4 and newer Greg Kroah-Hartman
2012-11-30 18:55 ` [ 51/56] powerpc/eeh: Lock module while handling EEH event Greg Kroah-Hartman
2012-11-30 18:55 ` [ 52/56] mmc: sdhci-s3c: fix the wrong number of max bus clocks Greg Kroah-Hartman
2012-11-30 18:55 ` [ 53/56] ARM: OMAP: counter: add locking to read_persistent_clock Greg Kroah-Hartman
2012-11-30 18:55 ` [ 54/56] timekeeping: Cast raw_interval to u64 to avoid shift overflow Greg Kroah-Hartman
2012-11-30 18:55 ` [ 55/56] net/wireless: ipw2200: Fix panic occurring in ipw_handle_promiscuous_tx() Greg Kroah-Hartman
2012-11-30 18:55 ` [ 56/56] iwlwifi: fix 6000 series channel switch command Greg Kroah-Hartman
2012-12-01 15:35 ` [ 00/56] 3.4.21-stable review Satoru Takeuchi
2012-12-02 2:08 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121130185121.120203034@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davej@redat.com \
--cc=dvhart@linux.intel.com \
--cc=jkacur@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).