Thomas Gleixner 7861053e37 futex: Handle faults correctly for PI futexes ... commit 34b1a1ce1458f50ef27c54e28eb9b1947012907a upstream fixup_pi_state_owner() tries to ensure that the state of the rtmutex, pi_state and the user space value related to the PI futex are consistent before returning to user space. In case that the user space value update faults and the fault cannot be resolved by faulting the page in via fault_in_user_writeable() the function returns with -EFAULT and leaves the rtmutex and pi_state owner state inconsistent. A subsequent futex_unlock_pi() operates on the inconsistent pi_state and releases the rtmutex despite not owning it which can corrupt the RB tree of the rtmutex and cause a subsequent kernel stack use after free. It was suggested to loop forever in fixup_pi_state_owner() if the fault cannot be resolved, but that results in runaway tasks which is especially undesired when the problem happens due to a programming error and not due to malice. As the user space value cannot be fixed up, the proper solution is to make the rtmutex and the pi_state consistent so both have the same owner. This leaves the user space value out of sync. Any subsequent operation on the futex will fail because the 10th rule of PI futexes (pi_state owner and user space value are consistent) has been violated. As a consequence this removes the inept attempts of 'fixing' the situation in case that the current task owns the rtmutex when returning with an unresolvable fault by unlocking the rtmutex which left pi_state::owner and rtmutex::owner out of sync in a different and only slightly less dangerous way. Fixes: 1b7558e457ed ("futexes: fix fault handling in futex_lock_pi") Reported-by: gzobqq@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-04-12 12:51:41 +08:00
..
bpf	bpf: Don't leak memory in bpf getsockopt when optlen == 0	2021-04-12 12:51:29 +08:00
cgroup	cgroup: Fix memory leak when parsing multiple source parameters	2021-03-16 16:43:52 +08:00
configs	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
debug	kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"	2021-03-16 16:39:45 +08:00
dma	swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"	2021-03-16 16:40:57 +08:00
events	exec: Transform exec_update_mutex into a rw_semaphore	2021-04-12 12:51:05 +08:00
gcov	gcov: add support for GCC 10.1	2021-03-16 16:36:10 +08:00
irq	genirq/irqdomain: Don't try to free an interrupt that has no mapping	2021-03-16 16:42:56 +08:00
livepatch	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
locking	rtmutex: Remove unused argument from rt_mutex_proxy_unlock()	2021-04-12 12:51:41 +08:00
power	PM: hibernate: remove the bogus call to get_gendisk() in software_resume()	2021-03-16 16:39:16 +08:00
printk	printk: handle blank console arguments passed in.	2021-03-16 16:37:21 +08:00
rcu	arm64: smp: Tell RCU about CPUs that fail to come online	2021-03-16 16:41:11 +08:00
sched	sched/fair: Check for idle core in wake_affine	2021-03-18 06:25:56 +00:00
time	tick/sched: Remove bogus boot "safety" check	2021-03-16 16:43:56 +08:00
tkernel	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
trace	tracing/kprobes: Do the notrace functions check without kprobes on ftrace	2021-04-12 12:51:21 +08:00
.gitignore	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
Kconfig.freezer	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
Kconfig.hz	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
Kconfig.locks	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
Kconfig.preempt	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
Makefile	elfcore: fix building with clang	2021-04-12 12:51:29 +08:00
acct.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
async.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
audit.c	audit: fix a net reference leak in audit_list_rules_send()	2021-03-16 16:29:25 +08:00
audit.h	audit: fix a net reference leak in audit_list_rules_send()	2021-03-16 16:29:25 +08:00
audit_fsnotify.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
audit_tree.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
audit_watch.c	audit: CONFIG_CHANGE don't log internal bookkeeping as an event	2021-03-16 16:36:51 +08:00
auditfilter.c	audit: fix a net reference leak in audit_list_rules_send()	2021-03-16 16:29:25 +08:00
auditsc.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
backtracetest.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
bounds.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
capability.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
compat.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
configs.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
context_tracking.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
cpu.c	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling	2021-03-16 16:42:28 +08:00
cpu_pm.c	kernel/cpu_pm: Fix uninitted local in cpu_pm	2021-03-16 16:29:48 +08:00
crash_core.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
crash_dump.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
cred.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
delayacct.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
dma.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
exec_domain.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
exit.c	don't dump the threads that had been already exiting when zapped.	2021-03-16 16:40:57 +08:00
extable.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
fail_function.c	fail_function: Remove a redundant mutex unlock	2021-03-16 16:41:23 +08:00
fork.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-04-12 12:51:05 +08:00
freezer.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
futex.c	futex: Handle faults correctly for PI futexes	2021-04-12 12:51:41 +08:00
gen_kheaders.sh	kbuild: add variables for compression tools	2021-03-16 16:35:19 +08:00
groups.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
hung_task.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
iomem.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
irq_work.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
jump_label.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kallsyms.c	kallsyms: Refactor kallsyms_show_value() to take cred	2021-03-16 16:31:37 +08:00
kcmp.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-04-12 12:51:05 +08:00
kcov.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kexec.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kexec_core.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kexec_elf.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kexec_file.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kexec_internal.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kheaders.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kmod.c	kmod: make request_module() return an error when autoloading is disabled	2021-03-16 16:26:15 +08:00
kprobes.c	kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE	2021-03-16 16:37:41 +08:00
ksysfs.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kthread.c	kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled	2021-03-16 16:40:21 +08:00
latencytop.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
module-internal.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
module.c	module: delay kobject uevent until after module init call	2021-03-16 16:43:55 +08:00
module_signature.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
module_signing.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
notifier.c	kernel/notifier.c: intercept duplicate registrations to avoid infinite loops	2021-03-16 16:36:43 +08:00
nsproxy.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
padata.c	padata: add separate cpuhp node for CPUHP_PADATA_DEAD	2021-03-16 16:28:57 +08:00
panic.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
params.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
pid.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
pid_namespace.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
profile.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
ptrace.c	ptrace: Set PF_SUPERPRIV when checking capability	2021-03-16 16:41:32 +08:00
range.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
reboot.c	reboot: fix overflow parsing reboot cpu number	2021-03-16 16:40:55 +08:00
relay.c	kernel/relay.c: fix memleak on destroy relay channel	2021-03-16 16:34:28 +08:00
resource.c	/dev/mem: Revoke mappings when a driver claims the region	2021-03-16 16:30:25 +08:00
rseq.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
seccomp.c	seccomp: Set PF_SUPERPRIV when checking capability	2021-03-16 16:41:32 +08:00
signal.c	ptrace: fix task_join_group_stop() for the case when current is traced	2021-03-16 16:40:18 +08:00
smp.c	smp: introduce a new interface smp_call_function_many_async	2021-03-18 06:25:56 +00:00
smpboot.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
smpboot.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
softirq.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
stackleak.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
stacktrace.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
stop_machine.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
sys.c	kernel/sys.c: avoid copying possible padding bytes in copy_to_user	2021-03-16 16:36:43 +08:00
sys_ni.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
sysctl-test.c	kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()	2021-03-16 16:36:31 +08:00
sysctl.c	net: rps using pvipi	2021-03-19 08:24:58 +00:00
sysctl_binary.c	net: change TCP_TIMEWAIT_LEN on runtime	2021-03-16 16:43:58 +08:00
task_work.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
taskstats.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
test_kprobes.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
torture.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
tracepoint.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
tsacct.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
ucount.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
uid16.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
uid16.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
umh.c	usermodehelper: reset umask to default before executing user process	2021-03-16 16:37:54 +08:00
up.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
user-return-notifier.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
user.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
user_namespace.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
utsname.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
utsname_sysctl.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
watchdog.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
watchdog_hld.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
workqueue.c	workqueue: Kick a worker based on the actual activation of delayed works	2021-04-12 12:51:05 +08:00
workqueue_internal.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00