From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754152AbaESMY0 (ORCPT ); Mon, 19 May 2014 08:24:26 -0400 Received: from terminus.zytor.com ([198.137.202.10]:58727 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752869AbaESMYW (ORCPT ); Mon, 19 May 2014 08:24:22 -0400 Date: Mon, 19 May 2014 05:22:31 -0700 From: tip-bot for Thomas Gleixner Message-ID: Cc: mingo@kernel.org, williams@redhat.com, torvalds@linux-foundation.org, peterz@infradead.org, jakub@redhat.com, rostedt@goodmis.org, bigeasy@linutronix.de, tglx@linutronix.de, laijs@cn.fujitsu.com, davidlohr@hp.com, linux-kernel@vger.kernel.org, hpa@zytor.com, darren@dvhart.com, davej@redhat.com, paulmck@linux.vnet.ibm.com, carlos@redhat.com, roland@hack.frob.com, mtk.manpages@gmail.com Reply-To: mingo@kernel.org, torvalds@linux-foundation.org, williams@redhat.com, peterz@infradead.org, jakub@redhat.com, rostedt@goodmis.org, bigeasy@linutronix.de, tglx@linutronix.de, davidlohr@hp.com, laijs@cn.fujitsu.com, linux-kernel@vger.kernel.org, hpa@zytor.com, darren@dvhart.com, davej@redhat.com, paulmck@linux.vnet.ibm.com, carlos@redhat.com, roland@hack.frob.com, mtk.manpages@gmail.com In-Reply-To: <20140512201701.194824402@linutronix.de> References: <20140512201701.194824402@linutronix.de> To: linux-tip-commits@vger.kernel.org Subject: [tip:core/urgent] futex: Prevent attaching to kernel threads Git-Commit-ID: f0d71b3dcb8332f7971b5f2363632573e6d9486a X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: f0d71b3dcb8332f7971b5f2363632573e6d9486a Gitweb: http://git.kernel.org/tip/f0d71b3dcb8332f7971b5f2363632573e6d9486a Author: Thomas Gleixner AuthorDate: Mon, 12 May 2014 20:45:35 +0000 Committer: Thomas Gleixner CommitDate: Mon, 19 May 2014 21:18:49 +0900 futex: Prevent attaching to kernel threads We happily allow userspace to declare a random kernel thread to be the owner of a user space PI futex. Found while analysing the fallout of Dave Jones syscall fuzzer. We also should validate the thread group for private futexes and find some fast way to validate whether the "alleged" owner has RW access on the file which backs the SHM, but that's a separate issue. Signed-off-by: Thomas Gleixner Cc: Dave Jones Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Darren Hart Cc: Davidlohr Bueso Cc: Steven Rostedt Cc: Clark Williams Cc: Paul McKenney Cc: Lai Jiangshan Cc: Roland McGrath Cc: Carlos ODonell Cc: Jakub Jelinek Cc: Michael Kerrisk Cc: Sebastian Andrzej Siewior Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org --- kernel/futex.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/futex.c b/kernel/futex.c index 7c68225..81dbe77 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -814,6 +814,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, if (!p) return -ESRCH; + if (!p->mm) { + put_task_struct(p); + return -EPERM; + } + /* * We need to look at the task state flags to figure out, * whether the task is exiting. To protect against the do_exit