[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-stable-commits
Subject:    patch futex_compat-fix-list-traversal-bugs.patch queued to -stable tree
From:       <gregkh () suse ! de>
Date:       2007-09-21 22:19:19
Message-ID: 20070921221841.2A0E51449FC0 () imap ! suse ! de
[Download RAW message or body]


This is a note to let you know that we have just queued up the patch titled

     Subject: futex_compat: fix list traversal bugs

to the 2.6.22-stable tree.  Its filename is

     futex_compat-fix-list-traversal-bugs.patch

A git repo of this tree can be found at 
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary


From stable-bounces@linux.kernel.org Tue Sep 11 15:24:28 2007
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 11 Sep 2007 15:23:49 -0700
Subject: futex_compat: fix list traversal bugs
To: torvalds@linux-foundation.org
Cc: arnd@arndb.de, stable@kernel.org, davem@davemloft.net, tglx@linutronix.de, \
                akpm@linux-foundation.org, mingo@elte.hu
Message-ID: <200709112223.l8BMNn8s032675@imap1.linux-foundation.org>


From: Arnd Bergmann <arnd@arndb.de>

commit 179c85ea53bef807621f335767e41e23f86f01df in mainline.

The futex list traversal on the compat side appears to have
a bug.

It's loop termination condition compares:

        while (compat_ptr(uentry) != &head->list)

But that can't be right because "uentry" has the special
"pi" indicator bit still potentially set at bit 0.  This
is cleared by fetch_robust_entry() into the "entry"
return value.

What this seems to mean is that the list won't terminate
when list iteration gets back to the the head.  And we'll
also process the list head like a normal entry, which could
cause all kinds of problems.

So we should check for equality with "entry".  That pointer
is of the non-compat type so we have to do a little casting
to keep the compiler and sparse happy.

The same problem can in theory occur with the 'pending'
variable, although that has not been reported from users
so far.

Based on the original patch from David Miller.

Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff -puN kernel/futex_compat.c~futex_compat-fix-list-traversal-bugs \
                kernel/futex_compat.c
--- a/kernel/futex_compat.c~futex_compat-fix-list-traversal-bugs
+++ a/kernel/futex_compat.c
@@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task
 	if (fetch_robust_entry(&upending, &pending,
 			       &head->list_op_pending, &pip))
 		return;
-	if (upending)
+	if (pending)
 		handle_futex_death((void __user *)pending + futex_offset, curr, pip);
 
-	while (compat_ptr(uentry) != &head->list) {
+	while (entry != (struct robust_list __user *) &head->list) {
 		/*
 		 * A pending lock might already be on the list, so
 		 * dont process it twice:
_

_______________________________________________
stable mailing list
stable@linux.kernel.org
http://linux.kernel.org/mailman/listinfo/stable



Patches currently in stable-queue which might be from arnd@arndb.de are

queue-2.6.22/futex_compat-fix-list-traversal-bugs.patch
-
To unsubscribe from this list: send the line "unsubscribe stable-commits" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[prev in list] [next in list] [prev in thread] [next in thread]