https://github.com/torvalds/linux
Revision e64ab2dbd882933b65cd82ff6235d705ad65dbb6 authored by Linus Torvalds on 28 July 2022, 09:31:12 UTC, committed by Linus Torvalds on 28 July 2022, 17:06:49 UTC
If a watch is being added to a queue, it needs to guard against
interference from addition of a new watch, manual removal of a watch and
removal of a watch due to some other queue being destroyed.

KEYCTL_WATCH_KEY guards against this for the same {key,queue} pair by
holding the key->sem writelocked and by holding refs on both the key and
the queue - but that doesn't prevent interaction from other {key,queue}
pairs.

While add_watch_to_object() does take the spinlock on the event queue,
it doesn't take the lock on the source's watch list.  The assumption was
that the caller would prevent that (say by taking key->sem) - but that
doesn't prevent interference from the destruction of another queue.

Fix this by locking the watcher list in add_watch_to_object().

Fixes: c73be61cede5 ("pipe: Add general notification queue support")
Reported-by: syzbot+03d7b43290037d1f87ca@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: keyrings@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent e0339f0
History
Tip revision: e64ab2dbd882933b65cd82ff6235d705ad65dbb6 authored by Linus Torvalds on 28 July 2022, 09:31:12 UTC
watch_queue: Fix missing locking in add_watch_to_object()
Tip revision: e64ab2d
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 19.8 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 71 bytes
.gitattributes -rw-r--r-- 62 bytes
.gitignore -rw-r--r-- 1.9 KB
.mailmap -rw-r--r-- 23.5 KB
COPYING -rw-r--r-- 496 bytes
CREDITS -rw-r--r-- 99.0 KB
Kbuild -rw-r--r-- 1.3 KB
Kconfig -rw-r--r-- 555 bytes
MAINTAINERS -rw-r--r-- 653.4 KB
Makefile -rw-r--r-- 64.1 KB
README -rw-r--r-- 727 bytes

README

back to top