futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
authorPeter Zijlstra <peterz@infradead.org>
Sat, 4 Mar 2017 09:27:18 +0000 (10:27 +0100)
committerThomas Gleixner <tglx@linutronix.de>
Tue, 14 Mar 2017 20:45:36 +0000 (21:45 +0100)
commitc236c8e95a3d395b0494e7108f0d41cf36ec107c
tree25c0e83f3b4458fb2982a8470876f99adce29cfe
parent4495c08e84729385774601b5146d51d9e5849f81
futex: Fix potential use-after-free in FUTEX_REQUEUE_PI

While working on the futex code, I stumbled over this potential
use-after-free scenario. Dmitry triggered it later with syzkaller.

pi_mutex is a pointer into pi_state, which we drop the reference on in
unqueue_me_pi(). So any access to that pointer after that is bad.

Since other sites already do rt_mutex_unlock() with hb->lock held, see
for example futex_lock_pi(), simply move the unlock before
unqueue_me_pi().

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20170304093558.801744246@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
kernel/futex.c