releases/2.6.23.2/fix-compat-futex-hangs.patch

   1 From stable-bounces@linux.kernel.org Mon Nov 12 23:59:27 2007
   2 From: David Miller <davem@davemloft.net>
   3 Date: Mon, 12 Nov 2007 23:59:05 -0800 (PST)
   4 Subject: Fix compat futex hangs.
   5 To: stable@kernel.org
   6 Cc: bunk@kernel.org
   7 Message-ID: <20071112.235905.219307536.davem@davemloft.net>
   8
   9 From: David Miller <davem@davemloft.net>
  10
  11 [FUTEX]: Fix address computation in compat code.
  12
  13 [ Upstream commit: 3c5fd9c77d609b51c0bab682c9d40cbb496ec6f1 ]
  14
  15 compat_exit_robust_list() computes a pointer to the
  16 futex entry in userspace as follows:
  17
  18         (void __user *)entry + futex_offset
  19
  20 'entry' is a 'struct robust_list __user *', and
  21 'futex_offset' is a 'compat_long_t' (typically a 's32').
  22
  23 Things explode if the 32-bit sign bit is set in futex_offset.
  24
  25 Type promotion sign extends futex_offset to a 64-bit value before
  26 adding it to 'entry'.
  27
  28 This triggered a problem on sparc64 running 32-bit applications which
  29 would lock up a cpu looping forever in the fault handling for the
  30 userspace load in handle_futex_death().
  31
  32 Compat userspace runs with address masking (wherein the cpu zeros out
  33 the top 32-bits of every effective address given to a memory operation
  34 instruction) so the sparc64 fault handler accounts for this by
  35 zero'ing out the top 32-bits of the fault address too.
  36
  37 Since the kernel properly uses the compat_uptr interfaces, kernel side
  38 accesses to compat userspace work too since they will only use
  39 addresses with the top 32-bit clear.
  40
  41 Because of this compat futex layer bug we get into the following loop
  42 when executing the get_user() load near the top of handle_futex_death():
  43
  44 1) load from address '0xfffffffff7f16bd8', FAULT
  45 2) fault handler clears upper 32-bits, processes fault
  46    for address '0xf7f16bd8' which succeeds
  47 3) goto #1
  48
  49 I want to thank Bernd Zeimetz, Josip Rodin, and Fabio Massimo Di Nitto
  50 for their tireless efforts helping me track down this bug.
  51
  52 Signed-off-by: David S. Miller <davem@davemloft.net>
  53 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  54 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  55
  56 ---
  57  kernel/futex_compat.c |   27 ++++++++++++++++++++-------
  58  1 file changed, 20 insertions(+), 7 deletions(-)
  59
  60 --- a/kernel/futex_compat.c
  61 +++ b/kernel/futex_compat.c
  62 @@ -29,6 +29,15 @@ fetch_robust_entry(compat_uptr_t *uentry
  63         return 0;
  64  }
  65
  66 +static void __user *futex_uaddr(struct robust_list *entry,
  67 +                               compat_long_t futex_offset)
  68 +{
  69 +       compat_uptr_t base = ptr_to_compat(entry);
  70 +       void __user *uaddr = compat_ptr(base + futex_offset);
  71 +
  72 +       return uaddr;
  73 +}
  74 +
  75  /*
  76   * Walk curr->robust_list (very carefully, it's a userspace list!)
  77   * and mark any locks found there dead, and notify any waiters.
  78 @@ -75,11 +84,13 @@ void compat_exit_robust_list(struct task
  79                  * A pending lock might already be on the list, so
  80                  * dont process it twice:
  81                  */
  82 -               if (entry != pending)
  83 -                       if (handle_futex_death((void __user *)entry + futex_offset,
  84 -                                               curr, pi))
  85 -                               return;
  86 +               if (entry != pending) {
  87 +                       void __user *uaddr = futex_uaddr(entry,
  88 +                                                        futex_offset);
  89
  90 +                       if (handle_futex_death(uaddr, curr, pi))
  91 +                               return;
  92 +               }
  93                 if (rc)
  94                         return;
  95                 uentry = next_uentry;
  96 @@ -93,9 +104,11 @@ void compat_exit_robust_list(struct task
  97
  98                 cond_resched();
  99         }
 100 -       if (pending)
 101 -               handle_futex_death((void __user *)pending + futex_offset,
 102 -                                  curr, pip);
 103 +       if (pending) {
 104 +               void __user *uaddr = futex_uaddr(pending, futex_offset);
 105 +
 106 +               handle_futex_death(uaddr, curr, pip);
 107 +       }
 108  }
 109
 110  asmlinkage long