futex: Validate atomic acquisition in futex_lock_pi_atomic() [Linux 3.15]

This Linux kernel change "futex: Validate atomic acquisition in futex_lock_pi_atomic()" is included in the Linux 3.15 release. This change is authored by Thomas Gleixner <tglx [at] linutronix.de> on Tue Jun 3 12:27:06 2014 +0000. The commit for this change in Linux stable tree is b3eaa9f (patch).

futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state.  If
it has, return -EINVAL.  The state is corrupted already, so no point in
cleaning it up.  Subsequent calls will fail as well.  Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
    restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Will Drewry <[email protected]>
Cc: [email protected]
Signed-off-by: Thomas Gleixner <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

There are 14 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 kernel/futex.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 663ea2b..520e7b2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -910,10 +910,18 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
        return -EDEADLK;

    /*
-    * Surprise - we got the lock. Just return to userspace:
+    * Surprise - we got the lock, but we do not trust user space at all.
     */
-   if (unlikely(!curval))
-       return 1;
+   if (unlikely(!curval)) {
+       /*
+        * We verify whether there is kernel state for this
+        * futex. If not, we can safely assume, that the 0 ->
+        * TID transition is correct. If state exists, we do
+        * not bother to fixup the user space state as it was
+        * corrupted already.
+        */
+       return futex_top_waiter(hb, key) ? -EINVAL : 1;
+   }

    uval = curval;

Leave a Reply

Your email address will not be published. Required fields are marked *