diff mbox series

[4.4,14/28] futex: Sanitize exit state handling

Message ID	20210202132941.759808490@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@kernel.org>, "Peter Zijlstra (Intel)" <peterz@infradead.org>, Lee Jones <lee.jones@linaro.org> Subject: [PATCH 4.4 14/28] futex: Sanitize exit state handling Date: Tue, 2 Feb 2021 14:38:34 +0100 Message-Id: <20210202132941.759808490@linuxfoundation.org> In-Reply-To: <20210202132941.180062901@linuxfoundation.org> References: <20210202132941.180062901@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.4,02/28] wext: fix NULL-ptr-dereference with cfg80211s lack of commit() [4.4,03/28] net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family [4.4,04/28] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] [4.4,05/28] mt7601u: fix kernel crash unplugging the device [4.4,06/28] mt7601u: fix rx buffer refcounting [4.4,07/28] y2038: futex: Move compat implementation into futex.c [4.4,08/28] futex: Move futex exit handling into futex code [4.4,09/28] futex: Replace PF_EXITPIDONE with a state [4.4,10/28] exit/exec: Seperate mm_release() [4.4,11/28] futex: Split futex_mm_release() for exit/exec [4.4,12/28] futex: Set task::futex_state to DEAD right after handling futex exit [4.4,13/28] futex: Mark the begin of futex exit explicitly [4.4,14/28] futex: Sanitize exit state handling [4.4,15/28] futex: Provide state handling for exec() as well [4.4,16/28] futex: Add mutex around futex exit [4.4,17/28] futex: Provide distinct return value when owner is exiting [4.4,18/28] futex: Prevent exit livelock [4.4,19/28] ARM: imx: build suspend-imx6.S with arm instruction set [4.4,20/28] netfilter: nft_dynset: add timeout extension to template [4.4,21/28] xfrm: Fix oops in xfrm_replay_advance_bmp [4.4,22/28] RDMA/cxgb4: Fix the reported max_recv_sge value [4.4,23/28] mac80211: pause TX while changing interface type [4.4,24/28] can: dev: prevent potential information leak in can_fill_info() [4.4,25/28] iommu/vt-d: Gracefully handle DMAR units with no supported address widths [4.4,26/28] iommu/vt-d: Dont dereference iommu_device if IOMMU_API is not built [4.4,27/28] NFC: fix resource leak when target index is invalid [4.4,28/28] NFC: fix possible resource leak

Commit Message

Greg Kroah-Hartman Feb. 2, 2021, 1:38 p.m. UTC

From: Thomas Gleixner <tglx@linutronix.de>

commit 4a8e991b91aca9e20705d434677ac013974e0e30 upstream.

Instead of having a smp_mb() and an empty lock/unlock of task::pi_lock move
the state setting into to the lock section.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.645603214@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c |   17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff mbox series

Patch

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3276,16 +3276,19 @@  void futex_exit_recursive(struct task_st
 
 void futex_exit_release(struct task_struct *tsk)
 {
-	tsk->futex_state = FUTEX_STATE_EXITING;
-	/*
-	 * Ensure that all new tsk->pi_lock acquisitions must observe
-	 * FUTEX_STATE_EXITING. Serializes against attach_to_pi_owner().
-	 */
-	smp_mb();
 	/*
-	 * Ensure that we must observe the pi_state in exit_pi_state_list().
+	 * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock.
+	 *
+	 * This ensures that all subsequent checks of tsk->futex_state in
+	 * attach_to_pi_owner() must observe FUTEX_STATE_EXITING with
+	 * tsk->pi_lock held.
+	 *
+	 * It guarantees also that a pi_state which was queued right before
+	 * the state change under tsk->pi_lock by a concurrent waiter must
+	 * be observed in exit_pi_state_list().
 	 */
 	raw_spin_lock_irq(&tsk->pi_lock);
+	tsk->futex_state = FUTEX_STATE_EXITING;
 	raw_spin_unlock_irq(&tsk->pi_lock);
 
 	futex_exec_release(tsk);