From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757629AbcLPX6h (ORCPT ); Fri, 16 Dec 2016 18:58:37 -0500 Received: from bombadil.infradead.org ([198.137.202.9]:46355 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755376AbcLPX6d (ORCPT ); Fri, 16 Dec 2016 18:58:33 -0500 Date: Fri, 16 Dec 2016 15:58:21 -0800 From: Darren Hart To: Peter Zijlstra Cc: tglx@linutronix.de, mingo@kernel.org, juri.lelli@arm.com, rostedt@goodmis.org, xlpang@redhat.com, bigeasy@linutronix.de, linux-kernel@vger.kernel.org, mathieu.desnoyers@efficios.com, jdesfossez@efficios.com, bristot@redhat.com Subject: Re: [PATCH -v4 01/10] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Message-ID: <20161216235821.GD62123@f23x64.localdomain> References: <20161213083638.938898295@infradead.org> <20161213085730.071348342@infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20161213085730.071348342@infradead.org> User-Agent: Mutt/1.7.1 (2016-10-04) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Dec 13, 2016 at 09:36:39AM +0100, Peter Zijlstra wrote: > While working on the futex code, I stumbled over this potential > use-after-free scenario. > > pi_mutex is a pointer into pi_state, which we drop the reference on in > unqueue_me_pi(). So any access to that pointer after that is bad. > > Since other sites already do rt_mutex_unlock() with hb->lock held, see > for example futex_lock_pi(), simply move the unlock before > unqueue_me_pi(). I believe this is unchanged from the previous version I reviewed. My only comment would be possibly noting in the commit message that in addition to EFAULT, ENOMEM and EHWPOISON from fixup_owner...fixup_user_fault() will now also result in the unlock, we saw no reason to handle those cases differently, but in case someone goes looking for the change, good to have it documented. This passed my minimal testing (selftests/futex/functional in CI with kvm on a dual socket Xeon "cpus=20,sockets=2,cores=5,threads=2"). Reviewed-by: Darren Hart -- Darren Hart Intel Open Source Technology Center