Revision - 89e9e66 - futex: Handle unlock_pi race gracefully - origin: https://github.com/torvalds/linux

visit type:

https://github.com/torvalds/linux

17 May 2024, 09:02:56 UTC

Revision 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 authored by Sebastian Andrzej Siewior on 15 April 2016, 12:35:39 UTC, committed by Thomas Gleixner on 20 April 2016, 10:33:13 UTC

futex: Handle unlock_pi race gracefully

If userspace calls UNLOCK_PI unconditionally without trying the TID -> 0
transition in user space first then the user space value might not have the
waiters bit set. This opens the following race:

CPU0	    	      	    CPU1
uval = get_user(futex)
			    lock(hb)
lock(hb)
			    futex |= FUTEX_WAITERS
			    ....
			    unlock(hb)

cmpxchg(futex, uval, newval)

So the cmpxchg fails and returns -EINVAL to user space, which is wrong because
the futex value is valid.

To handle this (yes, yet another) corner case gracefully, check for a flag
change and retry.

[ tglx: Massaged changelog and slightly reworked implementation ]

Fixes: ccf9e6a80d9e ("futex: Make unlock_pi more robust")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: stable@vger.kernel.org
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1460723739-5195-1-git-send-email-bigeasy@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

1 parent 6687659

Files
Changes

Permalinks

Tip revision: 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 authored by Sebastian Andrzej Siewior on 15 April 2016, 12:35:39 UTC
futex: Handle unlock_pi race gracefully

Tip revision: 89e9e66

File	Mode	Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.get_maintainer.ignore	-rw-r--r--	31 bytes
.gitignore	-rw-r--r--	1.2 KB
.mailmap	-rw-r--r--	5.5 KB
COPYING	-rw-r--r--	18.3 KB
CREDITS	-rw-r--r--	95.4 KB
Kbuild	-rw-r--r--	2.6 KB
Kconfig	-rw-r--r--	252 bytes
MAINTAINERS	-rw-r--r--	344.2 KB
Makefile	-rw-r--r--	55.0 KB
README	-rw-r--r--	18.1 KB
REPORTING-BUGS	-rw-r--r--	7.3 KB

Showing with 0 additions and 0 deletions (0 / 0 diffs computed)

Computing file changes ...

https://github.com/torvalds/linux

futex: Handle unlock_pi race gracefully

README