Peter Zijlstra c236c8e95a futex: Fix potential use-after-free in FUTEX_REQUEUE_PI ...

While working on the futex code, I stumbled over this potential
use-after-free scenario. Dmitry triggered it later with syzkaller.

pi_mutex is a pointer into pi_state, which we drop the reference on in
unqueue_me_pi(). So any access to that pointer after that is bad.

Since other sites already do rt_mutex_unlock() with hb->lock held, see
for example futex_lock_pi(), simply move the unlock before
unqueue_me_pi().

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20170304093558.801744246@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

2017-03-14 21:45:36 +01:00

..

bpf

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-03-04 17:31:39 -08:00

cgroup

scripts/spelling.txt: add "disble(d)" pattern and fix typo instances

2017-03-09 17:01:09 -08:00

configs

config: android-base: enable hardened usercopy and kernel ASLR

2017-02-27 18:43:46 -08:00

debug

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>

2017-03-02 08:42:34 +01:00

events

scripts/spelling.txt: add "disble(d)" pattern and fix typo instances

2017-03-09 17:01:09 -08:00

gcov

…

irq

sched/headers: Prepare to move the get_task_struct()/put_task_struct() and related APIs from <linux/sched.h> to <linux/sched/task.h>

2017-03-02 08:42:40 +01:00

livepatch

…

locking

Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-03-07 14:33:11 -08:00

power

Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-03-03 10:16:38 -08:00

printk

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>

2017-03-02 08:42:36 +01:00

rcu

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>

2017-03-02 08:42:34 +01:00

sched

Merge tag 'pm-4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2017-03-09 16:30:37 -08:00

time

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-03-07 14:45:22 -08:00

trace

scripts/spelling.txt: add "overide" pattern and fix typo instances

2017-03-09 17:01:09 -08:00

.gitignore

…

acct.c

sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>

2017-03-02 08:42:39 +01:00

async.c

…

audit_fsnotify.c

…

audit_tree.c

…

audit_watch.c

…

audit.c

Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit

2017-02-21 13:25:50 -08:00

audit.h

Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit

2017-02-21 13:25:50 -08:00

auditfilter.c

…

auditsc.c

Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit

2017-02-21 13:25:50 -08:00

backtracetest.c

…

bounds.c

…

capability.c

…

compat.c

…

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

crash_dump.c

…

cred.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/coredump.h>

2017-03-02 08:42:28 +01:00

delayacct.c

sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>

2017-03-02 08:42:39 +01:00

dma.c

…

elfcore.c

…

exec_domain.c

…

exit.c

userfaultfd: non-cooperative: rollback userfaultfd_exit

2017-03-09 17:01:09 -08:00

extable.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-02-22 10:15:09 -08:00

fork.c

sched/headers, RCU: Move rcu_copy_process() from <linux/sched/task.h> to kernel/fork.c

2017-03-03 01:43:46 +01:00

freezer.c

…

futex_compat.c

…

futex.c

futex: Fix potential use-after-free in FUTEX_REQUEUE_PI

2017-03-14 21:45:36 +01:00

groups.c

…

hung_task.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>

2017-03-02 08:42:34 +01:00

irq_work.c

…

jump_label.c

Merge tag 'trace-v4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

2017-02-27 13:26:17 -08:00

kallsyms.c

bpf: make jited programs visible in traces

2017-02-17 13:40:05 -05:00

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

…

kexec_core.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk

2017-02-22 17:33:34 -08:00

kexec_file.c

kexec, x86/purgatory: Unbreak it and clean it up

2017-03-10 20:55:09 +01:00

kexec_internal.h

kexec, x86/purgatory: Unbreak it and clean it up

2017-03-10 20:55:09 +01:00

kexec.c

…

kmod.c

sched/headers, vfs/execve: Prepare to move the do_execve*() prototypes from <linux/sched.h> to <linux/binfmts.h>

2017-03-02 08:42:39 +01:00

kprobes.c

Merge tag 'powerpc-4.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2017-02-22 10:30:38 -08:00

ksysfs.c

kernel/ksysfs.c: add __ro_after_init to bin_attribute structure

2017-02-24 17:46:56 -08:00

kthread.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

latencytop.c

sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>

2017-03-02 08:42:39 +01:00

Makefile

…

membarrier.c

Fix: Disable sys_membarrier when nohz_full is enabled

2017-01-23 11:32:16 -08:00

memremap.c

mm, devm_memremap_pages: hold device_hotplug lock over mem_hotplug_{begin, done}

2017-02-24 17:46:53 -08:00

module_signing.c

…

module-internal.h

…

module.c

Merge tag 'modules-for-v4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux

2017-02-22 17:08:33 -08:00

notifier.c

kernel/notifier.c: simplify expression

2017-02-24 17:46:56 -08:00

nsproxy.c

…

padata.c

…

panic.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>

2017-03-02 08:42:34 +01:00

params.c

…

pid_namespace.c

sched/headers: Prepare for the reduction of <linux/sched.h>'s signal API dependency

2017-03-02 08:42:37 +01:00

pid.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

profile.c

sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>

2017-03-02 08:42:39 +01:00

ptrace.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

range.c

…

reboot.c

…

relay.c

lib/vsprintf.c: remove %Z support

2017-02-27 18:43:47 -08:00

resource.c

…

seccomp.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>

2017-03-02 08:42:36 +01:00

signal.c

sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>

2017-03-02 08:42:39 +01:00

smp.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/idle.h>

2017-03-02 08:42:26 +01:00

smpboot.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

smpboot.h

…

softirq.c

…

stacktrace.c

stacktrace, lockdep: Fix address, newline ugliness

2017-02-08 08:21:31 +01:00

stop_machine.c

…

sys_ni.c

…

sys.c

sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>

2017-03-02 08:42:39 +01:00

sysctl_binary.c

…

sysctl.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/coredump.h>

2017-03-02 08:42:28 +01:00

task_work.c

…

taskstats.c

…

test_kprobes.c

…

torture.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h>

2017-03-02 08:42:27 +01:00

tracepoint.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

tsacct.c

sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>

2017-03-02 08:42:39 +01:00

ucount.c

ucount: Remove the atomicity from ucount->count

2017-03-06 15:26:37 -06:00

uid16.c

sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>

2017-03-02 08:42:31 +01:00

up.c

…

user_namespace.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>

2017-03-02 08:42:29 +01:00

user-return-notifier.c

…

user.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/user.h>

2017-03-02 08:42:29 +01:00

utsname_sysctl.c

sched/headers: Remove <linux/rwsem.h> from <linux/sched.h>

2017-03-03 01:45:36 +01:00

utsname.c

sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>

2017-03-02 08:42:38 +01:00

watchdog_hld.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>

2017-03-02 08:42:34 +01:00

watchdog.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>

2017-03-02 08:42:34 +01:00

workqueue_internal.h

…

workqueue.c

time: Remove CONFIG_TIMER_STATS

2017-02-10 11:15:08 +01:00