Attachment 237791 Details for Bug 353011 – futex compat list traversale bug fix

futex compat list traversale bug fix

futex_compat_list_traversal_bug.patch (text/plain), 1.93 KB, created by IBM Bug Proxy on 2007-10-25 19:06:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: IBM Bug Proxy

Created: 2007-10-25 19:06:10 UTC

Size: 1.93 KB

patch

obsolete

>futex_compat: fix list traversal bugs
>
>The futex list traversal on the compat side appears to have
>a bug.
>
>It's loop termination condition compares:
>
>        while (compat_ptr(uentry) != &head->list)
>
>But that can't be right because "uentry" has the special
>"pi" indicator bit still potentially set at bit 0.  This
>is cleared by fetch_robust_entry() into the "entry"
>return value.
>
>What this seems to mean is that the list won't terminate
>when list iteration gets back to the the head.  And we'll
>also process the list head like a normal entry, which could
>cause all kinds of problems.
>
>So we should check for equality with "entry".  That pointer
>is of the non-compat type so we have to do a little casting
>to keep the compiler and sparse happy.
>
>The same problem can in theory occur with the 'pending'
>variable, although that has not been reported from users
>so far.
>
>Based on the original patch from David Miller.
>
>Acked-by: Ingo Molnar <mingo@elte.hu>
>Cc: Thomas Gleixner <tglx@linutronix.de>
>Cc: David Miller <davem@davemloft.net>
>Signed-off-by: Arnd Bergmann <arnd@arndb.de>
>Cc: <stable@kernel.org>
>Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>---
>
>Index: linux-rt-2.6.21.4-ibmrt1.3-view/kernel/futex_compat.c
>===================================================================
>--- linux-rt-2.6.21.4-ibmrt1.3-view.orig/kernel/futex_compat.c	2007-09-30 22:47:59.000000000 -0500
>+++ linux-rt-2.6.21.4-ibmrt1.3-view/kernel/futex_compat.c	2007-09-30 22:48:42.000000000 -0500
>@@ -61,10 +61,10 @@
> 	if (fetch_robust_entry(&upending, &pending,
> 			       &head->list_op_pending, &pip))
> 		return;
>-	if (upending)
>+	if (pending)
> 		handle_futex_death((void __user *)pending + futex_offset, curr, pip);
> 
>-	while (compat_ptr(uentry) != &head->list) {
>+	while (entry != (struct robust_list __user *) &head->list) {
> 		/*
> 		 * A pending lock might already be on the list, so
> 		 * dont process it twice:

Actions: View

Attachments on bug 353011: 237791